Edit: /opt/dedrads/check_imap (5249B)
#!/bin/bash
LINESDEF="120000";
LINES=$LINESDEF
if [ $# -eq 3 ] && [ "$2" == "--lines" ];
then
LINES=$3;
#echo $LINES;
fi
if [ -f "/var/log/maillog" ]; then
MAIL_LOG="/var/log/maillog"
elif [ -f "/var/log/mail.log" ]; then
MAIL_LOG="/var/log/mail.log"
fi
#echo $LINES
function printUsage () {
echo "This script will check $MAIL_LOG and active running processes for imap related activity."
echo =Check Mailbox Usage Info=
echo;echo "$0 --topio"
echo "Will show a list of emails with bytes sent and received"
echo;echo "$0 --userconns"
echo "Show a sorted list of active imap processes per user";echo;
echo;echo "$0 --mailbox"
echo "Show a sorted list of active imap processes, sorted per mailbox";echo;
echo;echo "$0 --mboxsize"
echo "Show the size of the mailbox for all connected accounts.";
echo "(could drive the load and take some time - use with care)";echo;
echo;echo "$0 --user
"
echo "Shows a list of logins per hour, mailbox sizes and utilization for one user";echo;
echo =Check Basic Login Info=
echo;echo "$0 --login_email"
echo "Prints the email addresses with the most logins.";echo;
echo;echo "$0 --login_ip"
echo "Prints the IP addresses with the most logins.";echo;
echo;echo "$0 --login_failed"
echo "Prints highest number of failed logins by IP, address, and the both Address and IP.";echo;
echo;echo "$0 --option --lines NUMLINES"
echo "This will execute the option, checking NUMLINES back throgh the log file (default is ${LINESDEF})"
echo;echo "$0 --checkerror";
echo "Checks to see if you are hitting the maximum number allowed connections";
echo "(Use this if you get complaints of pop timing out or being slow to connect!)";
echo;echo "$0 --help"
echo "You're looking at it!"
}
case $1 in
--topio)
tail -${LINES-45000} $MAIL_LOG |awk '
/LOGOUT/ && /imapd/ && /user=/{
gsub(/rcvd=/,"",$11);
gsub(/sent=/,"",$12);
rcvd[$7]=rcvd[$7]+$11
sent[$7]=sent[$7]+$12
}
/LOGOUT/ && /pop3d/ && /user=/{
gsub(/sent=/,"",$13);
gsub(/rcvd=/,"",$12);
sent[$7]=sent[$7]+$13
rcvd[$7]=rcvd[$7]+$12
}
END{
for (key in sent) {
printf "%-80s %-10s %-10s\n",key,sent[key],rcvd[key];
}
}'
;;
--userconns)
ps auwx | grep imapd | awk '{if ($1 ~ /[a-z]+[0-9]+/){print $1}; }' | sort | uniq -c | sort -nk1
;;
--mailbox)
ps auwx | grep imapd | awk '{if ($1 ~ /[a-z]+[0-9]+/){print $12}; }' | sort |uniq -c | sort -nk1
;;
--mboxsize)
echo "this may take awhile - hit control-C to exit at any time"
for account in $(ps axuw |
grep "/usr/lib/courier-imap/bin/imapd /home/" |
grep -v root | awk '{ print $12 }'|sort | uniq);
do
du -h --max-depth=0 $account/cur;
done
;;
--login_ip)
tail -${LINES-45000} $MAIL_LOG | grep imapd | awk '{print $8}' | sed -e '/^$/d' | sort | uniq -c | sort -nk1
;;
--login_email)
tail -${LINES-45000} $MAIL_LOG | grep imapd | awk '/LOGIN/{print $7}' | sort | uniq -c | sort -nk1 | tail -2
;;
--login_failed)
echo "=Sorted by IP="
tail -${LINES-45000} $MAIL_LOG | grep imapd |awk '/LOGIN FAILED/{print $9 }' | sort | uniq -c | sort -nk1 | tail -15
echo "=Sorted by Address="
tail -${LINES-45000} $MAIL_LOG | grep imapd | awk '/LOGIN FAILED/{print $8 }' | sort | uniq -c | sort -nk1 | tail -15
echo "=Sorted by Address and IP="
tail -${LINES-45000} $MAIL_LOG | grep imapd | awk '/LOGIN FAILED/{print $8, $9}' | sort | uniq -c | sort -nk1 | tail -15
;;
--checkerror)
tail -${LINES-45000} $MAIL_LOG |grep "maximum active connections";
;;
--user)
IMAPUSER=$2
function IMAP_INBOX_MAIL() {
#Mail log lengh in hours =
START_D=$(date +%s --date="`head -1 $MAIL_LOG |awk '{print $1,$2, $3}'`"); \
END_D=$(date +%s --date="`tail -1 $MAIL_LOG |awk '{print $1, $2,$3}'`"); \
LOG_TIME=$(echo $END_D $START_D |awk '{print ($1-$2)/60/60}' |cut -d'.' -f1)
#User homedir =
HOMEDIR=$(grep $IMAPUSER /etc/passwd |awk -F':' '{print $6}')
paste \
<(for i in $(cat $HOMEDIR/etc/*/passwd |awk -F':' '{print $6}' |awk -F'mail/' '{print $2}' |grep [a-z] |awk -F'/' '{print $2"@"$1}'); \
do echo $i "`grep $i $MAIL_LOG |grep IMAP |grep LOGIN |wc -l`" |awk -v LTIME=${LOG_TIME} '{ if ($2>0) print $1, $2/LTIME" logins per hour :: " }'; \
done) \
<(IMAP_USERS=$(for i in $(cat $HOMEDIR/etc/*/passwd |awk -F':' '{print $6}' |awk -F 'mail/' '{print $2}' |grep [a-z] |awk -F'/' '{print $2"@"$1}'); \
do echo $i "`grep $i $MAIL_LOG |grep IMAP |grep LOGIN|wc -l`" |awk '{ if ($2>0) print }'; done); \
for i in $(printf "$IMAP_USERS\n" |awk '{print $1}'); \
do NAME=$(echo $i |cut -d'@' -f1); \
DOMAIN=$(echo $i |cut -d'@' -f2); \
IMAPUSER_MAILDIR=$(cat $HOMEDIR/etc/$DOMAIN/passwd |grep $NAME |tail -1 |awk -F':' '{print $6}' |grep [a-z]); \
echo "`ls $IMAPUSER_MAILDIR/cur/ |wc -l` emails `du -sh $IMAPUSER_MAILDIR/cur/ |awk '{print $1}'` inbox ::" \
"`find $IMAPUSER_MAILDIR/ -type f |wc -l` emails `du -sh $IMAPUSER_MAILDIR/ |awk '{print $1}'` total"; done) \
|awk '{ if ($7>0) print }' | sort -rnk7 |column -t
}
IMAP_INBOX_MAIL 2>/dev/null
;;
--help)
printUsage;
exit 0
;;
*)
printUsage;
exit 1
;;
esac