Check which rules hit

[Denis Beauchemin]

OK, this time I try to send it in a compressed format.

Denis

-----Message d'origine-----
De : MailScanner [mailto:mailscanner-bounces at lists.mailscanner.info] De la part de Denis Beauchemin
Envoyé : 19 juin 2015 08:27
À : MailScanner Discussion
Objet : RE: Check which rules hit

I created this script a while back just to do that:
#!/usr/bin/perl -w
#
# Script that looks through maillog to find all messages tagged as spam # by MailScanner.  It then tallies the different SpamAssassin rules that # fired.
# Denis Beauchemin, 20050516

use Getopt::Long;

# Where some commands reside:
my $GREP   = "/bin/grep";
my $GUNZIP = "/bin/gunzip";

# Value of "Spam =" in %report-dir%/languages.conf my $isSpamString  = "est un polluriel, SpamAssassin";
my $isHamString   = "est pas un polluriel, SpamAssassin";
my $allString     = " un polluriel, SpamAssassin";
# Value of "score =" in %report-dir%/languages.conf
my $scoreString   = "score=";
# Value of "required =" in %report-dir%/languages.conf
my $reqdString    = "requis ";
my $autoString    = "autolearn=spam";
my $cachedString  = "cached, ";
my $nCachedString = "not cached, ";

my $maillog = "/var/log/maillog";
@maillogs = ();

my $sortByName = 0;
my $sortByHits = 0;
my $getHam = 0;
my $getAll = 0;
my $help = 0;

GetOptions(
    'sortbyname|byname' => \$sortByName,
    'sortbyhits|byhits' => \$sortByHits,
    'log=s' => \@maillogs,
    'ham'   => \$getHam,
    'all'   => \$getAll,
    'help'  => \$help,
);

if ( $help ) {
    print '
This program tallies SpamAssassin\'s rules that were triggered when an email was detected as spam by MailScanner.

You can search for ham with the --ham option. 

You can search for all SpamAssassin results with the --all option.

By default it sorts the results by rule name. It can also sort them by number of hits if called with --sortbyhits (or --byhits).

The option --sortbyname (or --byname) is the default one.

If you don\'t want to use the current maillog, specify a different one with --log new-maillog.

All unknown command line parameters will be treated as additional file names to process.

It is OK for a log file to be gzipped.
';
    exit;
}

push @maillogs, @ARGV;
@maillogs = ( $maillog ) if ( @maillogs  == 0 ); #print "Maillogs: @maillogs\n"; #my $searchString = $getHam ? $isHamString : $isSpamString; my $searchString; if ( $getAll ) {
    $searchString = "$allString";
} elsif ( $getHam ) {
    $searchString = "$isHamString";
} else {
    $searchString = "$isSpamString";
}

foreach my $maillog ( @maillogs ) {
    print "Processing $maillog...\n";

    $sortByName++ if ( ( $sortByName == 0 ) && ( $sortByHits == 0 ) );

    my $openCmd = "LANG=C $GREP \"$searchString\" $maillog |";
    if ( $maillog =~ /\.gz$/ ) {
        $openCmd = "$GUNZIP -c $maillog | LANG=C $GREP \"$searchString\" |";
    }
    open LOG, "$openCmd" || die "Cannot open $maillog";

    while ( <LOG> ) {
        next unless /$searchString \((?:$cachedString|$nCachedString)$scoreString[-\d.]+, $reqdStrin
g[-\d.]+,(?: $autoString,)?(.*)$/;
        my $hits = $1;
        foreach my $hit ( $hits =~ / ([^\s]+) -?[\d.]+(?:,|\))/g ) {
            $hit{$hit}++;
        }
    }

    close LOG;
}

if ( $sortByName ) {
    foreach my $hit ( sort keys %hit ) {
        printf "%27s %5d\n", $hit, $hit{$hit};
    }
} elsif ( $sortByHits ) {
    foreach my $hit ( sort {$hit{$b}<=>$hit{$a}} keys %hit ) {
        printf "%27s %5d\n", $hit, $hit{$hit};
    }
}


-----Message d'origine-----
De : MailScanner [mailto:mailscanner-bounces at lists.mailscanner.info] De la part de Peter Nitschke Envoyé : 19 juin 2015 02:21 À : mailscanner at lists.mailscanner.info
Objet : Check which rules hit

I have built up a large number of rules for SA to use with MS and many are probably now obsolete.

How can I monitor which rules are getting hits?

Thanks.

Peter




--
MailScanner mailing list
mailscanner at lists.mailscanner.info
http://lists.mailscanner.info/listinfo/mailscanner



--
MailScanner mailing list
mailscanner at lists.mailscanner.info
http://lists.mailscanner.info/listinfo/mailscanner

-------------- next part --------------
A non-text attachment was scrubbed...
Name: sa-hits.gz
Type: application/x-gzip
Size: 1836 bytes
Desc: sa-hits.gz
URL: <http://lists.mailscanner.info/pipermail/mailscanner/attachments/20150619/b4e63aff/attachment.bin>