NAME - Builds received spam/ham report from mail log


    $Revision: 1.17 $


 Usage: [options]

   -l, --logfile=filename       logfile to read
                                (default: /var/log/maillog)
   -s, --start                  Sets date/time for start of reporting period
   -e, --end                    Sets date/time for end of reporting period
   -u, --userstats              Generates stats for the top spam victims
                                (default is 25; see -T)
   -H, --html                   Generates HTML report
                                (default: plain text)
   -T, --top=#                    Display top # spam victims
                                (# defaults to 25; -T implies -u)
   -h, --help                   Displays this message
   -V, --version                Display version info
   --mail=emailaddress          Sends report to emailaddress
   --sendmail=/path/to/sendmail Location of sendmail binary
                                (default: /usr/sbin/sendmail)
   --from=emailaddress          Sets From: field of mail
   -v, --verbose                Sets verbose mode (requires -D)
   -D, --debug                  Sets debug mode


Creates simple text report of spam/ham detected by SpamAssassin by parsing spamd entries in the mail log (generally /var/log/maillog)


To generate a text report from midnight to present using /var/log/maillog:

 ./ -s 'midnight' -e 'now' > sa_stats.txt

To generate an HTML report including the top 5 spam victims for the month of January 2004 from compressed mail logs:

 gunzip -c /var/log/maillog-200401*.gz | ./ -H -T 5 -l - \
 -s '2001-01-01 00:00:00' -e '2004-01-31 23:59:59' > jan_2004_stats.html

Note the use of '-' as a filename to represent STDIN.

To generate a text report with per-user stats from yesterday, reading from /var/log/mail and turning on all debugging output:

 ./ -v -D -u -l /var/log/mail \
 -s 'yesterday midnight' 1>stats.txt 2>stats.err


  • Are you running spamd? Currently only reads syslog entries from spamd; it doesn't work with MTA-level calls to Mail::SpamAssassin or with logs generated by the spamassassin perl script.

  • Are there spamd entries in your mail log? Use 'grep spamd /var/log/maillog' to find out.

  • Are there spamd entries in your mail log within the analysis interval? Run ' -v -D ...' to see the entries that are found and discarded as well as to see the actual analysis interval.


  • Getopt::Long


  • Time::Local

  • Date::Manip

  • Parse::Syslog;


  • Because of poor year handling in Parse::Syslog, the script may not work well when the log file dates back to the previous year.


  • Find bugs

  • Fix bugs

  • Don't call /usr/sbin/sendmail directly; use Mail::Internet or Net::SMTP or other standard module

  • Add support for compressed logs (see gzopen() from Compress::Zlib)

  • Have --verbose work without --debug


Brad Rathbun <>

Bob Apthorpe <>

Duncan Findlay <>


Mail::SpamAssassin, Date::Manip, spamd(1)