<div dir="ltr">check this <a href="http://www.milter.info/sendmail/milter-limit/">http://www.milter.info/sendmail/milter-limit/</a> its for sendmail but i think you could use it in postfix. <br><br><div class="gmail_quote">
2008/9/22 Josh Kidd <span dir="ltr"><<a href="mailto:jkidd@afflink.com">jkidd@afflink.com</a>></span><br><blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">
<div link="blue" vlink="purple" lang="EN-US">
<div>
<p><span>Don't
know if anyone else has attempted to do something like this before or</span><span style="font-size: 12pt;"> not, I
gave a scan to Google and the lists and didn't see anything. I have
MailScanner setup on a FreeBSD7 machine running Postfix+MailScanner(SA,ClamAV)+Mailwatch.
We are wanting to find a way that if a user's computer is infected and
starts sending out a large number of emails in a short time frame (ie: 20,30,50
messages in 2-5 minutes). </span></p>
<p><span style="font-size: 12pt;"> </span></p>
<p><span style="font-size: 12pt;">I
assume this would have to be a custom ruleset but being new to MailScanner I
don't know exactly how I would go about creating this rule. Has anyone
done something like this or know's how to? I want MailScanner or
Mailwatch to email me if a user's outbound mail volume exceeds our
pre-defined limits so I can shutdown whatever is sending out the large volume
of mail to prevent our domain from being blacklisted.</span></p>
<p><span style="font-size: 12pt;"> </span></p>
<p><span style="font-size: 12pt;">Thanks
in Advance,</span></p>
<p><span style="font-size: 12pt;">JK</span></p>
<p> </p>
</div>
</div>
<br>--<br>
MailScanner mailing list<br>
<a href="mailto:mailscanner@lists.mailscanner.info">mailscanner@lists.mailscanner.info</a><br>
<a href="http://lists.mailscanner.info/mailman/listinfo/mailscanner" target="_blank">http://lists.mailscanner.info/mailman/listinfo/mailscanner</a><br>
<br>
Before posting, read <a href="http://wiki.mailscanner.info/posting" target="_blank">http://wiki.mailscanner.info/posting</a><br>
<br>
Support MailScanner development - buy the book off the website!<br>
<br></blockquote></div><br></div>