On Wed, 2008-09-03 at 12:01 +0200, Thinline Maillist wrote: > Now I'm gonna to write an analyzer, which will walk through spamd log > daily and collect these records (only for spam with defined overscore) > and add some host information (whois). > You might consider writing it as an additional logwatch filter. The benefit is that logwatch already provides the hooks to prevent a log entry being scanned more than once. Filters are quite easy to write and install. I've used gawk, but any scripting or programming language should be fine.
Martin
