Edit: /opt/dedrads/check_spamd (2426B)
#!/bin/bash
LINESDEF="900000"
MAIL_LOG="/var/log/maillog";
if [ ! -f $MAIL_LOG ]; then
echo "Can't find $MAIL_LOG - bailing."
exit 1;
fi
function separatorbar {
echo "========================================================================================="
}
function printUsage () {
echo;echo "$0"
echo " Shows the username, number of scans, and average scantime from /var/log/maillog, sorted by number of messages scanned (default is 900000 lines back)"
echo;echo "$0 --lines NUM_LINES"
echo " Shows the username, number of scans, and average scantime from the last NUM_LINES of /var/log/maillog"
}
function avgspamd () {
#by volume (number of times appearing in the log
tail -${LINES:-$LINESDEF} $MAIL_LOG |
grep "spamd: result: " |
grep size= | grep user= |
awk '{print $12, $13, $14, $15, $16}' |
awk -F "," '{print $1, $2, $3, $4, $5}' | sort -k 3 | awk '{print $3}' | sort | uniq -c | sort -nk1 |
awk '{users+=1;total+=$1}END{print "Average scans per account: " total/users}'
}
function tot_avgspamd () {
#Hackish, but works.
NEW_DATA=$(
tail -${LINES:-$LINESDEF} $MAIL_LOG |
awk '!/^ +$/ && /spamd: result: / && /size=/ && /user=/{print $12, $13, $14, $15, $16}' |
awk -F "," '{gsub(/scantime|user/,"",$0);
gsub(/=/," ",$0);
if ($3 != "root" && $3 != "") {
usercount[$3]++;
userscan[$3]+=$1;
}
}
END{
for (key in userscan) {
if (usercount[key] > 0) { print key," - ",usercount[key]," - ",userscan[key]/usercount[key] }
else { print key,"null set"}
}
}' | sort -nk3
)
echo "$NEW_DATA" | awk '
BEGIN {
print "Username - Scans - Average";
}
!/Username|root/ {
print $0;
servercount+=$3;
serverscan+=$5;
total++;
}
END{
print "\n";
if ( total > 0){
print "Avg Account Scan Time: ", serverscan/total;
print "Server Average : ", servercount/total;
}
}'
}
function check_time () {
START=$(tail -${LINES:-900000} $MAIL_LOG | head -1|awk '{print $1,$2,$3}')
END=$(tail -${LINES:-900000} $MAIL_LOG | tail -1|awk '{print $1,$2,$3}')
echo "Logs from $START to $END";
}
if [ $# -gt 0 ];
then
case $1 in
--lines)
LINES=$2;
tot_avgspamd
check_time
#avgspamd
;;
--help) printUsage; exit;;
*) printUsage; exit 1;;
esac
else
#replaced a lot of junk with a series of awkings. should be con'd to perl
tot_avgspamd
check_time
#avgspamd
fi