sa-stats.pl - Builds received spam/ham report from mail log
$Revision: 1.17 $
Usage: sa-stats.pl [options] Options: -l, --logfile=filename logfile to read (default: /var/log/maillog) -s, --start Sets date/time for start of reporting period -e, --end Sets date/time for end of reporting period -u, --userstats Generates stats for the top spam victims (default is 25; see -T) -H, --html Generates HTML report (default: plain text) -T, --top=# Display top # spam victims (# defaults to 25; -T implies -u) -h, --help Displays this message -V, --version Display version info --mail=emailaddress Sends report to emailaddress --sendmail=/path/to/sendmail Location of sendmail binary (default: /usr/sbin/sendmail) --from=emailaddress Sets From: field of mail -v, --verbose Sets verbose mode (requires -D) -D, --debug Sets debug mode
Creates simple text report of spam/ham detected by SpamAssassin by parsing spamd entries in the mail log (generally /var/log/maillog)
To generate a text report from midnight to present using /var/log/maillog:
./sa-stats.pl -s 'midnight' -e 'now' > sa_stats.txt
To generate an HTML report including the top 5 spam victims for the month of January 2004 from compressed mail logs:
gunzip -c /var/log/maillog-200401*.gz | ./sa-stats.pl -H -T 5 -l - \ -s '2001-01-01 00:00:00' -e '2004-01-31 23:59:59' > jan_2004_stats.html
Note the use of '-' as a filename to represent STDIN.
To generate a text report with per-user stats from yesterday, reading from /var/log/mail and turning on all debugging output:
./sa-stats.pl -v -D -u -l /var/log/mail \ -s 'yesterday midnight' 1>stats.txt 2>stats.err
Are you running spamd? Currently sa-stats.pl only reads syslog entries from spamd; it doesn't work with MTA-level calls to Mail::SpamAssassin or with logs generated by the spamassassin perl script.
Are there spamd entries in your mail log? Use 'grep spamd /var/log/maillog' to find out.
Are there spamd entries in your mail log within the analysis interval? Run 'sa-stats.pl -v -D ...' to see the entries that are found and discarded as well as to see the actual analysis interval.
Because of poor year handling in Parse::Syslog, the script may not work well when the log file dates back to the previous year.
Don't call /usr/sbin/sendmail directly; use Mail::Internet or Net::SMTP or other standard module
Add support for compressed logs (see gzopen() from Compress::Zlib)
Have --verbose work without --debug
Brad Rathbun <email@example.com> http://www.computechnv.com/
Bob Apthorpe <firstname.lastname@example.org> http://www.cynistar.net/~apthorpe/
Duncan Findlay <email@example.com>
Mail::SpamAssassin, Date::Manip, spamd(1)