<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;
mso-fareast-language:EN-US;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:#954F72;
text-decoration:underline;}
p.MsoPlainText, li.MsoPlainText, div.MsoPlainText
{mso-style-priority:99;
mso-style-link:"Texte brut Car";
margin:0cm;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;
mso-fareast-language:EN-US;}
span.TextebrutCar
{mso-style-name:"Texte brut Car";
mso-style-priority:99;
mso-style-link:"Texte brut";
font-family:"Calibri",sans-serif;}
span.EmailStyle19
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:72.0pt 90.0pt 72.0pt 90.0pt;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="FR-CA" link="#0563C1" vlink="#954F72">
<div class="WordSection1">
<p class="MsoNormal"><span lang="EN-CA" style="color:#1F497D">Peter, post some log lines and I will make it work for you.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-CA" style="color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-CA" style="color:#1F497D">Denis</span><b><span lang="EN-CA" style="color:black;mso-fareast-language:FR-CA">
</span></b><b><span style="color:black;mso-fareast-language:FR-CA"><o:p></o:p></span></b></p>
<p class="MsoNormal" style="page-break-after:avoid;text-autospace:none"><b><span style="color:black;mso-fareast-language:FR-CA"><o:p> </o:p></span></b></p>
<p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><b><span lang="FR" style="mso-fareast-language:FR-CA">De :</span></b><span lang="FR" style="mso-fareast-language:FR-CA"> MailScanner [mailto:mailscanner-bounces@lists.mailscanner.info]
<b>De la part de</b> Peter Nitschke<br>
<b>Envoyé :</b> 24 juin 2015 08:55<br>
<b>À :</b> mailscanner@lists.mailscanner.info<br>
<b>Objet :</b> RE: Check which rules hit<o:p></o:p></span></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><span style="font-size:12.0pt;font-family:"Times New Roman",serif;mso-fareast-language:FR-CA">o;?
</span><span style="font-size:12.0pt;font-family:"Times New Roman",serif;mso-fareast-language:FR-CA"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:12.0pt;font-family:"Times New Roman",serif;mso-fareast-language:FR-CA">Scrap that, I deleted the line with "cached" as my logs don't have that and now I am getting screen output.<o:p></o:p></span></p>
<div>
<p class="MsoNormal"><span style="font-size:12.0pt;font-family:"Times New Roman",serif;mso-fareast-language:FR-CA"> <o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:12.0pt;font-family:"Times New Roman",serif;mso-fareast-language:FR-CA">However it looks as though deleting the "cached" line is causing errors. Is there a better way to deal with that?<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:12.0pt;font-family:"Times New Roman",serif;mso-fareast-language:FR-CA"> <o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:12.0pt;font-family:"Times New Roman",serif;mso-fareast-language:FR-CA">Peter<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:12.0pt;font-family:"Times New Roman",serif;mso-fareast-language:FR-CA"><br>
</span><span style="font-size:10.0pt;font-family:"Arial",sans-serif;mso-fareast-language:FR-CA">*********** REPLY SEPARATOR ***********<br>
<br>
On 24/06/2015 at 10:13 PM Peter Nitschke wrote:</span><span style="font-size:12.0pt;font-family:"Times New Roman",serif;mso-fareast-language:FR-CA"><o:p></o:p></span></p>
</div>
<blockquote style="border:none;border-left:solid black 1.5pt;padding:0cm 0cm 0cm 4.0pt;margin-left:3.75pt;margin-top:5.0pt;margin-bottom:5.0pt">
<div>
<p class="MsoNormal"><span style="font-size:12.0pt;font-family:"Times New Roman",serif;mso-fareast-language:FR-CA">Is the output to screen or to a file?<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:12.0pt;font-family:"Times New Roman",serif;mso-fareast-language:FR-CA"> <o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:12.0pt;font-family:"Times New Roman",serif;mso-fareast-language:FR-CA">Thanks.<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:12.0pt;font-family:"Times New Roman",serif;mso-fareast-language:FR-CA"><br>
</span><span style="font-size:10.0pt;font-family:"Arial",sans-serif;mso-fareast-language:FR-CA">*********** REPLY SEPARATOR ***********<br>
<br>
On 22/06/2015 at 5:51 PM Denis Beauchemin wrote:</span><span style="font-size:12.0pt;font-family:"Times New Roman",serif;mso-fareast-language:FR-CA"><o:p></o:p></span></p>
</div>
<blockquote style="border:none;border-left:solid black 1.5pt;padding:0cm 0cm 0cm 4.0pt;margin-left:3.75pt;margin-top:5.0pt;margin-bottom:5.0pt">
<p class="MsoPlainText"><span lang="EN-CA">My log lines look like this:<o:p></o:p></span></p>
<p class="MsoPlainText"><span lang="EN-CA">Jun 22 13:26:16 10.32.103.21 smtps2 MailScanner[47071]: Message t5MHQFDv033375 from 10.32.106.21 (<a href="mailto:someone@usherbrooke.ca">someone@usherbrooke.ca</a>) to usherbrooke.ca is n'<span style="background:yellow;mso-highlight:yellow">est
pas un polluriel, SpamAssassin</span> (<span style="background:lime;mso-highlight:lime">not cached,</span>
<span style="background:aqua;mso-highlight:aqua">score=</span>-6.206, <span style="background:gray;mso-highlight:gray">
requis</span> 6.5, autolearn=not spam, BAYES_00 -1.90, HTML_MESSAGE 0.00, RDNS_NONE 0.79, UDES_FROM01 -3.00, UDES_FROM02 -0.10, UDES_FROMTO01 -2.00)<o:p></o:p></span></p>
<p class="MsoPlainText"><span lang="EN-CA">Jun 22 13:27:23 10.32.103.28 smtpe1 MailScanner[61090]: Message t5MHR8mw063252 from 64.5.96.10 (<a href="mailto:someone@alliinclusive.space">someone@alliinclusive.space</a>) to usherbrooke.ca is
<span style="background:yellow;mso-highlight:yellow">est un polluriel, SpamAssassin</span> (<span style="background:lime;mso-highlight:lime">not cached,</span>
<span style="background:aqua;mso-highlight:aqua">score=</span>7.776, <span style="background:gray;mso-highlight:gray">
requis</span> 6.5, <span style="background:silver;mso-highlight:silver">autolearn=spam</span>, BAYES_50 0.80, HTML_EXTRA_CLOSE 0.00, HTML_MESSAGE 0.00, HTML_TAG_BALANCE_BODY 1.16, MIME_HTML_ONLY 0.72, MIME_HTML_ONLY_MULTI 0.00, MPART_ALT_DIFF 0.79, RDNS_NONE
0.79, STYLE_GIBBERISH 3.50, T_REMOTE_IMAGE 0.01)<o:p></o:p></span></p>
<p class="MsoPlainText"><span lang="EN-CA"><o:p> </o:p></span></p>
<p class="MsoPlainText"><span lang="EN-CA">The script does a first grep for the strings in
<span style="background:yellow;mso-highlight:yellow">yellow</span>. Thereb third string that matches all ham/spam:
<span style="background:yellow;mso-highlight:yellow">un polluriel, SpamAssassin</span><o:p></o:p></span></p>
<p class="MsoPlainText"><span lang="EN-CA"><o:p> </o:p></span></p>
<p class="MsoPlainText"><span lang="EN-CA">Then Perl is used to search for lines that match:<o:p></o:p></span></p>
<p class="MsoPlainText" style="margin-left:36.0pt;text-indent:-18.0pt"><span lang="EN-CA">1-</span><span lang="EN-CA" style="font-size:7.0pt;font-family:"Times New Roman",serif">
</span><span lang="EN-CA">The <span style="background:yellow;mso-highlight:yellow">
yellow</span> string followed by b <o:p></o:p></span></p>
<p class="MsoPlainText" style="margin-left:36.0pt;text-indent:-18.0pt"><span lang="EN-CA">2-</span><span lang="EN-CA" style="font-size:7.0pt;font-family:"Times New Roman",serif">
</span><span lang="EN-CA">Then the <span style="background:lime;mso-highlight:lime">
green</span> string (could also be b <o:p></o:p></span></p>
<p class="MsoPlainText" style="margin-left:36.0pt;text-indent:-18.0pt"><span lang="EN-CA">3-</span><span lang="EN-CA" style="font-size:7.0pt;font-family:"Times New Roman",serif">
</span><span lang="EN-CA">Then the <span style="background:aqua;mso-highlight:aqua">
blue</span> strings, including the digits, decimal point and minus sign<o:p></o:p></span></p>
<p class="MsoPlainText" style="margin-left:36.0pt;text-indent:-18.0pt"><span lang="EN-CA">4-</span><span lang="EN-CA" style="font-size:7.0pt;font-family:"Times New Roman",serif">
</span><span lang="EN-CA">Then the <span style="background:gray;mso-highlight:gray">
dark grey</span> strings, including the digits, decimal point and minus sign<o:p></o:p></span></p>
<p class="MsoPlainText" style="margin-left:36.0pt;text-indent:-18.0pt"><span lang="EN-CA">5-</span><span lang="EN-CA" style="font-size:7.0pt;font-family:"Times New Roman",serif">
</span><span lang="EN-CA">Then the <span style="background:silver;mso-highlight:silver">
light gray</span> string that could be omitted<o:p></o:p></span></p>
<p class="MsoPlainText" style="margin-left:36.0pt;text-indent:-18.0pt"><span lang="EN-CA">6-</span><span lang="EN-CA" style="font-size:7.0pt;font-family:"Times New Roman",serif">
</span><span lang="EN-CA">Then all the rules names and their respective score (could be negative)<o:p></o:p></span></p>
<p class="MsoPlainText"><span lang="EN-CA"><o:p> </o:p></span></p>
<p class="MsoPlainText"><span lang="EN-CA">At the end the matching rules are printed sorted as requested.<o:p></o:p></span></p>
<p class="MsoPlainText"><span lang="EN-CA"><o:p> </o:p></span></p>
<p class="MsoPlainText"><span lang="EN-CA">Denis<o:p></o:p></span></p>
<p class="MsoPlainText"><span lang="EN-CA"><o:p> </o:p></span></p>
<p class="MsoPlainText"><span lang="FR" style="mso-fareast-language:FR-CA">-----Message d'origine-----<br>
De : MailScanner [<a href="mailto:mailscanner-bounces@lists.mailscanner.info">mailto:mailscanner-bounces@lists.mailscanner.info</a>] De la part de Peter Nitschke<br>
EnvoyC) : 22 juin 2015 13:21<br>
C <a href="mailto:mailscanner@lists.mailscanner.info">mailscanner@lists.mailscanner.info</a><br>
Objet : RE: Check which rules hit</span><o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText"><span lang="EN-CA">This looks interesting.<o:p></o:p></span></p>
<p class="MsoPlainText"><span lang="EN-CA"><o:p> </o:p></span></p>
<p class="MsoPlainText"><span lang="EN-CA">I edited to English for spam, not spam etc, but when I run it, it just says "processing /var/log/maillog" and is very fast, but I get nothing, no output to screen or file that I can find.<o:p></o:p></span></p>
<p class="MsoPlainText"><span lang="EN-CA"><o:p> </o:p></span></p>
<p class="MsoPlainText"><span lang="EN-CA">Any suggestions how I can understand it better?<o:p></o:p></span></p>
<p class="MsoPlainText"><span lang="EN-CA"><o:p> </o:p></span></p>
<p class="MsoPlainText"><span lang="EN-CA">Thanks,<o:p></o:p></span></p>
<p class="MsoPlainText"><span lang="EN-CA"><o:p> </o:p></span></p>
<p class="MsoPlainText"><span lang="EN-CA">Peter<o:p></o:p></span></p>
<p class="MsoPlainText"><span lang="EN-CA"><o:p> </o:p></span></p>
<p class="MsoPlainText"><span lang="EN-CA"><o:p> </o:p></span></p>
<p class="MsoPlainText"><span lang="EN-CA">*********** REPLY SEPARATOR ***********<o:p></o:p></span></p>
<p class="MsoPlainText"><span lang="EN-CA"><o:p> </o:p></span></p>
<p class="MsoPlainText"><span lang="EN-CA">On 19/06/2015 at 12:26 PM Denis Beauchemin wrote:<o:p></o:p></span></p>
<p class="MsoPlainText"><span lang="EN-CA"><o:p> </o:p></span></p>
<p class="MsoPlainText"><span lang="EN-CA">>This encoded message has been converted to an attachment.<o:p></o:p></span></p>
<p class="MsoPlainText"><span lang="EN-CA">><o:p> </o:p></span></p>
<p class="MsoPlainText"><span lang="EN-CA">>I created this script a while back just to do that:<o:p></o:p></span></p>
<p class="MsoPlainText"><span lang="EN-CA">>#!/usr/bin/perl -w<o:p></o:p></span></p>
<p class="MsoPlainText"><span lang="EN-CA">>#<o:p></o:p></span></p>
<p class="MsoPlainText"><span lang="EN-CA">># Script that looks through maillog to find all messages tagged as spam
<o:p></o:p></span></p>
<p class="MsoPlainText"><span lang="EN-CA">># by MailScanner. It then tallies the different SpamAssassin rules
<o:p></o:p></span></p>
<p class="MsoPlainText"><span lang="EN-CA">>that # fired.<o:p></o:p></span></p>
<p class="MsoPlainText"><span lang="EN-CA">># Denis Beauchemin, 20050516<o:p></o:p></span></p>
<p class="MsoPlainText"><span lang="EN-CA">><o:p> </o:p></span></p>
<p class="MsoPlainText"><span lang="EN-CA">>use Getopt::Long;<o:p></o:p></span></p>
<p class="MsoPlainText"><span lang="EN-CA">><o:p> </o:p></span></p>
<p class="MsoPlainText"><span lang="EN-CA">># Where some commands reside:<o:p></o:p></span></p>
<p class="MsoPlainText"><span lang="EN-CA">>my $GREP = "/bin/grep";<o:p></o:p></span></p>
<p class="MsoPlainText"><span lang="EN-CA">>my $GUNZIP = "/bin/gunzip";<o:p></o:p></span></p>
<p class="MsoPlainText"><span lang="EN-CA">><o:p> </o:p></span></p>
<p class="MsoPlainText"><span lang="EN-CA">># Value of "Spam =" in %report-dir%/languages.conf my $isSpamString =
<o:p></o:p></span></p>
<p class="MsoPlainText"><span lang="EN-CA">>"est un polluriel, SpamAssassin";<o:p></o:p></span></p>
<p class="MsoPlainText"><span lang="EN-CA">>my $isHamString = "est pas un polluriel, SpamAssassin";<o:p></o:p></span></p>
<p class="MsoPlainText"><span lang="EN-CA">>my $allString = " un polluriel, SpamAssassin";<o:p></o:p></span></p>
<p class="MsoPlainText"><span lang="EN-CA">># Value of "score =" in %report-dir%/languages.conf<o:p></o:p></span></p>
<p class="MsoPlainText"><span lang="EN-CA">>my $scoreString = "score=";<o:p></o:p></span></p>
<p class="MsoPlainText"><span lang="EN-CA">># Value of "required =" in %report-dir%/languages.conf<o:p></o:p></span></p>
<p class="MsoPlainText"><span lang="EN-CA">>my $reqdString = "requis ";<o:p></o:p></span></p>
<p class="MsoPlainText"><span lang="EN-CA">>my $autoString = "autolearn=spam";<o:p></o:p></span></p>
<p class="MsoPlainText"><span lang="EN-CA">>my $cachedString = "cached, ";<o:p></o:p></span></p>
<p class="MsoPlainText"><span lang="EN-CA">>my $nCachedString = "not cached, ";<o:p></o:p></span></p>
<p class="MsoPlainText"><span lang="EN-CA">><o:p> </o:p></span></p>
<p class="MsoPlainText"><span lang="EN-CA">>my $maillog = "/var/log/maillog";<o:p></o:p></span></p>
<p class="MsoPlainText"><span lang="EN-CA">>@maillogs = ();<o:p></o:p></span></p>
<p class="MsoPlainText"><span lang="EN-CA">><o:p> </o:p></span></p>
<p class="MsoPlainText"><span lang="EN-CA">>my $sortByName = 0;<o:p></o:p></span></p>
<p class="MsoPlainText"><span lang="EN-CA">>my $sortByHits = 0;<o:p></o:p></span></p>
<p class="MsoPlainText"><span lang="EN-CA">>my $getHam = 0;<o:p></o:p></span></p>
<p class="MsoPlainText"><span lang="EN-CA">>my $getAll = 0;<o:p></o:p></span></p>
<p class="MsoPlainText"><span lang="EN-CA">>my $help = 0;<o:p></o:p></span></p>
<p class="MsoPlainText"><span lang="EN-CA">><o:p> </o:p></span></p>
<p class="MsoPlainText"><span lang="EN-CA">>GetOptions(<o:p></o:p></span></p>
<p class="MsoPlainText"><span lang="EN-CA">> 'sortbyname|byname' => \$sortByName,<o:p></o:p></span></p>
<p class="MsoPlainText"><span lang="EN-CA">> 'sortbyhits|byhits' => \$sortByHits,<o:p></o:p></span></p>
<p class="MsoPlainText"><span lang="EN-CA">> 'log=s' => \@maillogs,<o:p></o:p></span></p>
<p class="MsoPlainText"><span lang="EN-CA">> 'ham' => \$getHam,<o:p></o:p></span></p>
<p class="MsoPlainText"><span lang="EN-CA">> 'all' => \$getAll,<o:p></o:p></span></p>
<p class="MsoPlainText"><span lang="EN-CA">> 'help' => \$help,<o:p></o:p></span></p>
<p class="MsoPlainText"><span lang="EN-CA">>);<o:p></o:p></span></p>
<p class="MsoPlainText"><span lang="EN-CA">><o:p> </o:p></span></p>
<p class="MsoPlainText"><span lang="EN-CA">>if ( $help ) {<o:p></o:p></span></p>
<p class="MsoPlainText"><span lang="EN-CA">> print '<o:p></o:p></span></p>
<p class="MsoPlainText"><span lang="EN-CA">>This program tallies SpamAssassin\'s rules that were triggered when an
<o:p></o:p></span></p>
<p class="MsoPlainText"><span lang="EN-CA">>email was detected as spam by MailScanner.<o:p></o:p></span></p>
<p class="MsoPlainText"><span lang="EN-CA">><o:p> </o:p></span></p>
<p class="MsoPlainText"><span lang="EN-CA">>You can search for ham with the --ham option.
<o:p></o:p></span></p>
<p class="MsoPlainText"><span lang="EN-CA">><o:p> </o:p></span></p>
<p class="MsoPlainText"><span lang="EN-CA">>You can search for all SpamAssassin results with the --all option.<o:p></o:p></span></p>
<p class="MsoPlainText"><span lang="EN-CA">><o:p> </o:p></span></p>
<p class="MsoPlainText"><span lang="EN-CA">>By default it sorts the results by rule name. It can also sort them by
<o:p></o:p></span></p>
<p class="MsoPlainText"><span lang="EN-CA">>number of hits if called with --sortbyhits (or --byhits).<o:p></o:p></span></p>
<p class="MsoPlainText"><span lang="EN-CA">><o:p> </o:p></span></p>
<p class="MsoPlainText"><span lang="EN-CA">>The option --sortbyname (or --byname) is the default one.<o:p></o:p></span></p>
<p class="MsoPlainText"><span lang="EN-CA">><o:p> </o:p></span></p>
<p class="MsoPlainText"><span lang="EN-CA">>If you don\'t want to use the current maillog, specify a different one
<o:p></o:p></span></p>
<p class="MsoPlainText"><span lang="EN-CA">>with --log new-maillog.<o:p></o:p></span></p>
<p class="MsoPlainText"><span lang="EN-CA">><o:p> </o:p></span></p>
<p class="MsoPlainText"><span lang="EN-CA">>All unknown command line parameters will be treated as additional file
<o:p></o:p></span></p>
<p class="MsoPlainText"><span lang="EN-CA">>names to process.<o:p></o:p></span></p>
<p class="MsoPlainText"><span lang="EN-CA">><o:p> </o:p></span></p>
<p class="MsoPlainText"><span lang="EN-CA">>It is OK for a log file to be gzipped.<o:p></o:p></span></p>
<p class="MsoPlainText"><span lang="EN-CA">>';<o:p></o:p></span></p>
<p class="MsoPlainText"><span lang="EN-CA">> exit;<o:p></o:p></span></p>
<p class="MsoPlainText"><span lang="EN-CA">>}<o:p></o:p></span></p>
<p class="MsoPlainText"><span lang="EN-CA">><o:p> </o:p></span></p>
<p class="MsoPlainText"><span lang="EN-CA">>push @maillogs, @ARGV;<o:p></o:p></span></p>
<p class="MsoPlainText"><span lang="EN-CA">>@maillogs = ( $maillog ) if ( @maillogs == 0 ); #print "Maillogs:
<o:p></o:p></span></p>
<p class="MsoPlainText"><span lang="EN-CA">>@maillogs\n"; #my $searchString = $getHam ? $isHamString :
<o:p></o:p></span></p>
<p class="MsoPlainText"><span lang="EN-CA">>$isSpamString; my $searchString; if ( $getAll ) {<o:p></o:p></span></p>
<p class="MsoPlainText"><span lang="EN-CA">> $searchString = "$allString";<o:p></o:p></span></p>
<p class="MsoPlainText"><span lang="EN-CA">>} elsif ( $getHam ) {<o:p></o:p></span></p>
<p class="MsoPlainText"><span lang="EN-CA">> $searchString = "$isHamString";<o:p></o:p></span></p>
<p class="MsoPlainText"><span lang="EN-CA">>} else {<o:p></o:p></span></p>
<p class="MsoPlainText"><span lang="EN-CA">> $searchString = "$isSpamString";<o:p></o:p></span></p>
<p class="MsoPlainText"><span lang="EN-CA">>}<o:p></o:p></span></p>
<p class="MsoPlainText"><span lang="EN-CA">><o:p> </o:p></span></p>
<p class="MsoPlainText"><span lang="EN-CA">>foreach my $maillog ( @maillogs ) {<o:p></o:p></span></p>
<p class="MsoPlainText"><span lang="EN-CA">> print "Processing $maillog...\n";<o:p></o:p></span></p>
<p class="MsoPlainText"><span lang="EN-CA">><o:p> </o:p></span></p>
<p class="MsoPlainText"><span lang="EN-CA">> $sortByName++ if ( ( $sortByName == 0 ) && ( $sortByHits == 0<o:p></o:p></span></p>
<p class="MsoPlainText"><span lang="EN-CA">) );<o:p></o:p></span></p>
<p class="MsoPlainText"><span lang="EN-CA">><o:p> </o:p></span></p>
<p class="MsoPlainText"><span lang="EN-CA">> my $openCmd = "LANG=C $GREP \"$searchString\" $maillog |";<o:p></o:p></span></p>
<p class="MsoPlainText"><span lang="EN-CA">> if ( $maillog =~ /\.gz$/ ) {<o:p></o:p></span></p>
<p class="MsoPlainText"><span lang="EN-CA">> $openCmd = "$GUNZIP -c $maillog | LANG=C $GREP<o:p></o:p></span></p>
<p class="MsoPlainText"><span lang="EN-CA">\"$searchString\"<o:p></o:p></span></p>
<p class="MsoPlainText"><span lang="EN-CA">>|";<o:p></o:p></span></p>
<p class="MsoPlainText"><span lang="EN-CA">> }<o:p></o:p></span></p>
<p class="MsoPlainText"><span lang="EN-CA">> open LOG, "$openCmd" || die "Cannot open $maillog";<o:p></o:p></span></p>
<p class="MsoPlainText"><span lang="EN-CA">><o:p> </o:p></span></p>
<p class="MsoPlainText"><span lang="EN-CA">> while ( <LOG> ) {<o:p></o:p></span></p>
<p class="MsoPlainText"><span lang="EN-CA">> next unless /$searchString<o:p></o:p></span></p>
<p class="MsoPlainText"><span lang="EN-CA">>\((?:$cachedString|$nCachedString)$scoreString[-\d.]+, $reqdStrin<o:p></o:p></span></p>
<p class="MsoPlainText"><span lang="EN-CA">>g[-\d.]+,(?: $autoString,)?(.*)$/;<o:p></o:p></span></p>
<p class="MsoPlainText"><span lang="EN-CA">> my $hits = $1;<o:p></o:p></span></p>
<p class="MsoPlainText"><span lang="EN-CA">> foreach my $hit ( $hits =~ / ([^\s]+) -?[\d.]+(?:,|\))/g ) {<o:p></o:p></span></p>
<p class="MsoPlainText"><span lang="EN-CA">> $hit{$hit}++;<o:p></o:p></span></p>
<p class="MsoPlainText"><span lang="EN-CA">> }<o:p></o:p></span></p>
<p class="MsoPlainText"><span lang="EN-CA">> }<o:p></o:p></span></p>
<p class="MsoPlainText"><span lang="EN-CA">><o:p> </o:p></span></p>
<p class="MsoPlainText"><span lang="EN-CA">> close LOG;<o:p></o:p></span></p>
<p class="MsoPlainText"><span lang="EN-CA">>}<o:p></o:p></span></p>
<p class="MsoPlainText"><span lang="EN-CA">><o:p> </o:p></span></p>
<p class="MsoPlainText"><span lang="EN-CA">>if ( $sortByName ) {<o:p></o:p></span></p>
<p class="MsoPlainText"><span lang="EN-CA">> foreach my $hit ( sort keys %hit ) {<o:p></o:p></span></p>
<p class="MsoPlainText"><span lang="EN-CA">> printf "%27s %5d\n", $hit, $hit{$hit};<o:p></o:p></span></p>
<p class="MsoPlainText"><span lang="EN-CA">> }<o:p></o:p></span></p>
<p class="MsoPlainText"><span lang="EN-CA">>} elsif ( $sortByHits ) {<o:p></o:p></span></p>
<p class="MsoPlainText"><span lang="EN-CA">> foreach my $hit ( sort {$hit{$b}<=>$hit{$a}} keys %hit ) {<o:p></o:p></span></p>
<p class="MsoPlainText"><span lang="EN-CA">> printf "%27s %5d\n", $hit, $hit{$hit};<o:p></o:p></span></p>
<p class="MsoPlainText"><span lang="EN-CA">> }<o:p></o:p></span></p>
<p class="MsoPlainText"><span lang="EN-CA">>}<o:p></o:p></span></p>
<p class="MsoPlainText"><span lang="EN-CA">><o:p> </o:p></span></p>
<p class="MsoPlainText"><span lang="EN-CA">><o:p> </o:p></span></p>
<p class="MsoPlainText"><span lang="EN-CA">>-----Message d'origine-----<o:p></o:p></span></p>
<p class="MsoPlainText"><span lang="EN-CA">>De : MailScanner [<a href="mailto:mailscanner-bounces@lists.mailscanner.info"><span style="color:windowtext;text-decoration:none">mailto:mailscanner-bounces@lists.mailscanner.info</span></a>]<o:p></o:p></span></p>
<p class="MsoPlainText"><span lang="EN-CA">De<o:p></o:p></span></p>
<p class="MsoPlainText"><span lang="EN-CA">>la part de Peter Nitschke<o:p></o:p></span></p>
<p class="MsoPlainText"><span lang="EN-CA">>EnvoyC) : 19 juin 2015 02:21<o:p></o:p></span></p>
<p class="MsoPlainText"><span lang="EN-CA">>C href="<a href="mailto:mailscanner@lists.mailscanner.info">mailto:mailscanner@lists.mailscanner.info</a>"><a href="mailto:mailscanner@lists.mailscanner.info">mailscanner@lists.mailscanner.info</a><o:p></o:p></span></p>
<p class="MsoPlainText"><span lang="EN-CA">>Objet : Check which rules hit<o:p></o:p></span></p>
<p class="MsoPlainText"><span lang="EN-CA">><o:p> </o:p></span></p>
<p class="MsoPlainText"><span lang="EN-CA">>I have built up a large number of rules for SA to use with MS and many
<o:p></o:p></span></p>
<p class="MsoPlainText"><span lang="EN-CA">>are probably now obsolete.<o:p></o:p></span></p>
<p class="MsoPlainText"><span lang="EN-CA">><o:p> </o:p></span></p>
<p class="MsoPlainText"><span lang="EN-CA">>How can I monitor which rules are getting hits?<o:p></o:p></span></p>
<p class="MsoPlainText"><span lang="EN-CA">><o:p> </o:p></span></p>
<p class="MsoPlainText"><span lang="EN-CA">>Thanks.<o:p></o:p></span></p>
<p class="MsoPlainText"><span lang="EN-CA">><o:p> </o:p></span></p>
<p class="MsoPlainText"><span lang="EN-CA">>Peter<o:p></o:p></span></p>
<p class="MsoPlainText"><span lang="EN-CA">><o:p> </o:p></span></p>
<p class="MsoPlainText"><span lang="EN-CA">><o:p> </o:p></span></p>
<p class="MsoPlainText"><span lang="EN-CA">><o:p> </o:p></span></p>
<p class="MsoPlainText"><span lang="EN-CA">><o:p> </o:p></span></p>
<p class="MsoPlainText"><span lang="EN-CA">>--<o:p></o:p></span></p>
<p class="MsoPlainText"><span lang="EN-CA">>MailScanner mailing list<o:p></o:p></span></p>
<p class="MsoPlainText"><span lang="EN-CA">><a href="mailto:mailscanner@lists.mailscanner.info"><span style="color:windowtext;text-decoration:none">mailscanner@lists.mailscanner.info</span></a><o:p></o:p></span></p>
<p class="MsoPlainText"><span lang="EN-CA">><a href="http://lists.mailscanner.info/listinfo/mailscanner"><span style="color:windowtext;text-decoration:none">http://lists.mailscanner.info/listinfo/mailscanner</span></a><o:p></o:p></span></p>
<p class="MsoPlainText"><span lang="EN-CA">><o:p> </o:p></span></p>
<p class="MsoPlainText"><span lang="EN-CA">><o:p> </o:p></span></p>
<p class="MsoPlainText"><span lang="EN-CA"><o:p> </o:p></span></p>
<p class="MsoPlainText"><span lang="EN-CA">--<o:p></o:p></span></p>
<p class="MsoPlainText"><span lang="EN-CA">MailScanner mailing<o:p></o:p></span></p>
<p class="MsoPlainText"><span lang="EN-CA">>list<o:p></o:p></span></p>
<p class="MsoPlainText"><span lang="EN-CA"><a href="mailto:mailscanner@lists.mailscanner.info"><span style="color:windowtext;text-decoration:none">mailscanner@lists.mailscanner.info</span></a><o:p></o:p></span></p>
<p class="MsoPlainText"><span lang="EN-CA"><a href="http://lists.mailscanner.info/listinfo/mailscanner"><span style="color:windowtext;text-decoration:none">http://lists.mailscanner.info/listinfo/mailscanner</span></a><o:p></o:p></span></p>
<p class="MsoPlainText"><span lang="EN-CA"><o:p> </o:p></span></p>
<p class="MsoPlainText"><span lang="EN-CA"><o:p> </o:p></span></p>
<p class="MsoPlainText"><span lang="EN-CA"><o:p> </o:p></span></p>
</blockquote>
</blockquote>
</div>
</body>
</html>