Announce: mailscanner-mrtg version 0.03 is out!

[Dale Lovelace]

  Hi, I had to go with the sendmail value because I don't use MailScanner for virus scanning, and I suspect there are others that don't. When you only use MailScanner for spam detection the regex you are using have won't work :-)

  I think for 0.04 I will make a configuration option of whether to scan MailScanner or SendMail for MailBytes... I'll up the MaxBytes as well, I had only run the MailBytes for an hour before I released, so I hadn't maxed it out yet, I did quickly thereafter :-)

  Thanks Guys!
  Dale

> -----Original Message-----
> From: Richard Lynch [mailto:rich at MAIL.WVNET.EDU]
> Sent: Thursday, December 12, 2002 8:32 PM
> To: MAILSCANNER at JISCMAIL.AC.UK
> Subject: Re: Announce: mailscanner-mrtg version 0.03 is out!
> 
> On Thu, 2002-12-12 at 16:25, Denis Beauchemin wrote:
> > Le jeu 12/12/2002 à 16:10, Ryan Pitt a écrit :
> >
> > > Only thing I have seen so far that seems odd is the "Bytes of Mail
> > > Processed" is showing nothing even though there is activity on the
> > > server.  Do I need to be logging extra info in order for this graph to
> > > be populated?
> >
> > Same here. I tried to convert it to MB (modifying
> > /usr/sbin/mailscanner-mrtg), thinking that the value may be too high (I
> > don't know much about MRTG) and tweaking the values in
> > /etc/mrtg/mailscanner-mrtg.cfg but I still get zilch!
> >
> > Denis
> 
> I think the main problem is that the values in the
> /etc/mrtg/mailscanner-mrtg.cfg file are too small. I changed then to...
> 
>   MaxBytes[mailbytes]: 1000000000
>   AbsMax[mailbytes]: 2000000000
> 
> Also, for us, the computation of the value by /usr/bin/mailscanner-mrtg
> takes over two minutes to compute.  I changed the regular express that
> computes the value from...
> 
> >       if (/.+sendmail\[\d+\]:\s+\w+:\s+from=\S+,\s+size=(\d+),.+/i) {
> 
> ...to...
> 
> >       if (/Scanning \d+ messages, (\d+) bytes/) {
> 
> This is on lines 299 and 304.  Dale's method is more accurate (and gives
> a larger value) since it uses the sendmail message to acquire the size.
> My change uses MailScanner's value for the number of bytes scanned.  The
> reason it's faster is because MailScanner scans a batch of messages at
> one time and so there are fewer of them.  Also the regex is less
> complicated.  The result is that it takes less than 3 seconds to
> compute.  I like Dale's better but it's too expensive on our servers for
> the amount of mail we process.  I think it comes down to Dale's method
> represents the number of bytes received on the server and my method
> represents the number of bytes scanned by MailScanner.
> 
> --
> Richard Lynch <rich at mail.wvnet.edu>