SyslogScan::Daemon::BlacklistDetector - notice when a mail server has been blacklisted
plugin SyslogScan::Daemon::BlacklistDetector debug 0 bld_plugin SyslogScan::Daemon::BlacklistDetector::Postfix debug 0 rx_ourIP 127\.0\.0\.1 logpath /var/log/mail.log bld_plugin SyslogScan::Daemon::BlacklistDetector::EmailNotify debug 0 notify your@email.here renotify_time 7200 forget_time 3600 sendfrom root clean_time 1800 maxkeep 100
SyslogScan::Daemon::BlacklistDetector watches the mail log for SMTP reject messages that indicate that your mail server has been blacklisted by another site.
SyslogScan::Daemon::BlacklistDetector is a plugin for SyslogScan::Daemon. The SYNOPSIS shows the configuration lines you might use in /etc/syslogscand.conf to turn on the blacklist detector.
/etc/syslogscand.conf
The configuration prefix for plugins for SyslogScan::Daemon::BlacklistDetector is bld_. Use bld_plugin to load plugins.
bld_
bld_plugin
SyslogScan::Daemon::BlacklistDetector defines the following configuration parameters which may be given in indented lines that follow plugin SyslogScan::Daemon::BlacklistDetector or with the confuration prefix (bld_) anywhere in the configuration file after the plugin SyslogScan::Daemon::BlacklistDetector line.
plugin SyslogScan::Daemon::BlacklistDetector
(default 0) Turn on debugging.
Plugins for SyslogScan::Daemon::BlacklistDetector should subclass SyslogScan::Daemon::BlacklistDetector::Plugin. Except for new() and preconfig(), all of these methods are optional.
SyslogScan::Daemon::BlacklistDetector::Plugin
new()
preconfig()
SyslogScan::Daemon::BlacklistDetector will invoke the following methods on its plugins:
See notes for plugins for SyslogScan::Daemon.
Called after one of the regular expressions returned by get_logs() matched a log line. The arguments are the log filename where the match was found and the regular expression that matched. Passed implicitly are the line that was matched ($_) and any of the numbered regular expression submatches ($1, $2, etc).
get_logs()
$_
$1
$2
The return value is a %hash of information. The hash should be completely empty if the log line is not a SMPT rejection.
The following keys are required:
This should be deferred for a 4XX rejection and bounced for a 5XX rejection.
deferred
bounced
This should be the whole log line ($_).
The IP address used by the MTA for sending email. This may be unknown.
unknown
The domain of the recipient that bounced.
The recipient that bounced.
The return value is the %info hash passed to exactly one of the following: grelisted(), recipient_reject(), sender_reject(), content_reject() realtime_reject(), and blacklisted().
%info
grelisted()
recipient_reject()
sender_reject()
content_reject()
realtime_reject()
blacklisted()
This is called if the logline returned by parse_logs() contatins the word greylisted.
logline
parse_logs()
greylisted
This is called if the logline returned by parse_logs() matches a regular expression that indicates that the rejection was due to being sent to a particular recipient.
The regular expression is hard-coded to encourage everyone to share any changes with the author.
This is called if the logline returned by parse_logs() matches a regular expression that indicates that the rejection was due to being sent from a particular sender.
This is called if the logline returned by parse_logs() matches a regular expression that indicates that the rejection was due to the content of the message sent.
This is called if the logline returned by parse_logs() matches a regular expression that indicates that the rejection was due to a transitory blacklist.
This is called for lines that don't match the regular expressions for grelisted(), realtime_reject(), sender_reject(), or recipient_reject() or content_reject().
Copyright (C) 2006, David Muir Sharnoff <muir@idiom.com>
This module may be used and copied on the same terms as Perl itself.
If you need help writing additional modules for BlacklistDetector.pm, I'm usually available to do so. Inquire for rates.
The context for the blacklist detector: SyslogScan::Daemon, Plugins, Plugins::API.
Plugins for the blacklist detector: SyslogScan::Daemon::BlacklistDetector::Postfix, SyslogScan::Daemon::BlacklistDetector::EmailNotify.
To install SyslogScan::Daemon::BlacklistDetector, copy and paste the appropriate command in to your terminal.
cpanm
cpanm SyslogScan::Daemon::BlacklistDetector
CPAN shell
perl -MCPAN -e shell install SyslogScan::Daemon::BlacklistDetector
For more information on module installation, please visit the detailed CPAN module installation guide.