Check which rules hit
Peter Nitschke
email at ace.net.au
Wed Jun 24 12:54:04 UTC 2015
Scrap that, I deleted the line with "cached" as my logs don't have that and
now I am getting screen output.
However it looks as though deleting the "cached" line is causing errors.
Is there a better way to deal with that?
Peter
*********** REPLY SEPARATOR ***********
On 24/06/2015 at 10:13 PM Peter Nitschke wrote:
Is the output to screen or to a file?
Thanks.
*********** REPLY SEPARATOR ***********
On 22/06/2015 at 5:51 PM Denis Beauchemin wrote:
My log lines look like this:
Jun 22 13:26:16 10.32.103.21 smtps2 MailScanner[47071]: Message
t5MHQFDv033375 from 10.32.106.21 (someone at usherbrooke.ca) to usherbrooke.ca
is n'est pas un polluriel, SpamAssassin (not cached, score=-6.206, requis
6.5, autolearn=not spam, BAYES_00 -1.90, HTML_MESSAGE 0.00, RDNS_NONE
0.79, UDES_FROM01 -3.00, UDES_FROM02 -0.10, UDES_FROMTO01 -2.00)
Jun 22 13:27:23 10.32.103.28 smtpe1 MailScanner[61090]: Message
t5MHR8mw063252 from 64.5.96.10 (someone at alliinclusive.space) to
usherbrooke.ca is est un polluriel, SpamAssassin (not cached,
score=7.776, requis 6.5, autolearn=spam, BAYES_50 0.80,
HTML_EXTRA_CLOSE 0.00, HTML_MESSAGE 0.00, HTML_TAG_BALANCE_BODY 1.16,
MIME_HTML_ONLY 0.72, MIME_HTML_ONLY_MULTI 0.00, MPART_ALT_DIFF 0.79,
RDNS_NONE 0.79, STYLE_GIBBERISH 3.50, T_REMOTE_IMAGE 0.01)
The script does a first grep for the strings in yellow. There�s a third
string that matches all ham/spam: un polluriel, SpamAssassin
Then Perl is used to search for lines that match:
1- The yellow string followed by � (�
2- Then the green string (could also be �cached�)
3- Then the blue strings, including the digits, decimal point and
minus sign
4- Then the dark grey strings, including the digits, decimal point and
minus sign
5- Then the light gray string that could be omitted
6- Then all the rules names and their respective score (could be
negative)
At the end the matching rules are printed sorted as requested.
Denis
-----Message d'origine-----
De : MailScanner [mailto:mailscanner-bounces at lists.mailscanner.info] De la
part de Peter Nitschke
Envoy� : 22 juin 2015 13:21
� : mailscanner at lists.mailscanner.info
Objet : RE: Check which rules hit
This looks interesting.
I edited to English for spam, not spam etc, but when I run it, it just says
"processing /var/log/maillog" and is very fast, but I get nothing, no
output to screen or file that I can find.
Any suggestions how I can understand it better?
Thanks,
Peter
*********** REPLY SEPARATOR ***********
On 19/06/2015 at 12:26 PM Denis Beauchemin wrote:
>This encoded message has been converted to an attachment.
>
>I created this script a while back just to do that:
>#!/usr/bin/perl -w
>#
># Script that looks through maillog to find all messages tagged as spam
># by MailScanner. It then tallies the different SpamAssassin rules
>that # fired.
># Denis Beauchemin, 20050516
>
>use Getopt::Long;
>
># Where some commands reside:
>my $GREP = "/bin/grep";
>my $GUNZIP = "/bin/gunzip";
>
># Value of "Spam =" in %report-dir%/languages.conf my $isSpamString =
>"est un polluriel, SpamAssassin";
>my $isHamString = "est pas un polluriel, SpamAssassin";
>my $allString = " un polluriel, SpamAssassin";
># Value of "score =" in %report-dir%/languages.conf
>my $scoreString = "score=";
># Value of "required =" in %report-dir%/languages.conf
>my $reqdString = "requis ";
>my $autoString = "autolearn=spam";
>my $cachedString = "cached, ";
>my $nCachedString = "not cached, ";
>
>my $maillog = "/var/log/maillog";
>@maillogs = ();
>
>my $sortByName = 0;
>my $sortByHits = 0;
>my $getHam = 0;
>my $getAll = 0;
>my $help = 0;
>
>GetOptions(
> 'sortbyname|byname' => \$sortByName,
> 'sortbyhits|byhits' => \$sortByHits,
> 'log=s' => \@maillogs,
> 'ham' => \$getHam,
> 'all' => \$getAll,
> 'help' => \$help,
>);
>
>if ( $help ) {
> print '
>This program tallies SpamAssassin\'s rules that were triggered when an
>email was detected as spam by MailScanner.
>
>You can search for ham with the --ham option.
>
>You can search for all SpamAssassin results with the --all option.
>
>By default it sorts the results by rule name. It can also sort them by
>number of hits if called with --sortbyhits (or --byhits).
>
>The option --sortbyname (or --byname) is the default one.
>
>If you don\'t want to use the current maillog, specify a different one
>with --log new-maillog.
>
>All unknown command line parameters will be treated as additional file
>names to process.
>
>It is OK for a log file to be gzipped.
>';
> exit;
>}
>
>push @maillogs, @ARGV;
>@maillogs = ( $maillog ) if ( @maillogs == 0 ); #print "Maillogs:
>@maillogs\n"; #my $searchString = $getHam ? $isHamString :
>$isSpamString; my $searchString; if ( $getAll ) {
> $searchString = "$allString";
>} elsif ( $getHam ) {
> $searchString = "$isHamString";
>} else {
> $searchString = "$isSpamString";
>}
>
>foreach my $maillog ( @maillogs ) {
> print "Processing $maillog...\n";
>
> $sortByName++ if ( ( $sortByName == 0 ) && ( $sortByHits == 0
) );
>
> my $openCmd = "LANG=C $GREP \"$searchString\" $maillog |";
> if ( $maillog =~ /\.gz$/ ) {
> $openCmd = "$GUNZIP -c $maillog | LANG=C $GREP
\"$searchString\"
>|";
> }
> open LOG, "$openCmd" || die "Cannot open $maillog";
>
> while ( <LOG> ) {
> next unless /$searchString
>\((?:$cachedString|$nCachedString)$scoreString[-\d.]+, $reqdStrin
>g[-\d.]+,(?: $autoString,)?(.*)$/;
> my $hits = $1;
> foreach my $hit ( $hits =~ / ([^\s]+) -?[\d.]+(?:,|\))/g ) {
> $hit{$hit}++;
> }
> }
>
> close LOG;
>}
>
>if ( $sortByName ) {
> foreach my $hit ( sort keys %hit ) {
> printf "%27s %5d\n", $hit, $hit{$hit};
> }
>} elsif ( $sortByHits ) {
> foreach my $hit ( sort {$hit{$b}<=>$hit{$a}} keys %hit ) {
> printf "%27s %5d\n", $hit, $hit{$hit};
> }
>}
>
>
>-----Message d'origine-----
>De : MailScanner [mailto:mailscanner-bounces at lists.mailscanner.info]
De
>la part de Peter Nitschke
>Envoy� : 19 juin 2015 02:21
>� : mailscanner at lists.mailscanner.info
>Objet : Check which rules hit
>
>I have built up a large number of rules for SA to use with MS and many
>are probably now obsolete.
>
>How can I monitor which rules are getting hits?
>
>Thanks.
>
>Peter
>
>
>
>
>--
>MailScanner mailing list
>mailscanner at lists.mailscanner.info
>http://lists.mailscanner.info/listinfo/mailscanner
>
>
--
MailScanner mailing
>list
mailscanner at lists.mailscanner.info
http://lists.mailscanner.info/listinfo/mailscanner
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.mailscanner.info/pipermail/mailscanner/attachments/20150624/13cc0aae/attachment.html>
More information about the MailScanner
mailing list