FM / dedrads

/opt/dedrads

Name	Size	Mode	Actions
account_review/	-	0555	rm
check_software_mods/	-	0555	rm
cms_tools/	-	0555	rm
etc/	-	0555	rm
extras/	-	0555	rm
mailparse/	-	0555	rm
mysql/	-	0555	rm
nlp_scripts/	-	0555	rm
oldrads/	-	0555	rm
perl/	-	0555	rm
provision/	-	0555	rm
python/	-	0555	rm
suspended/	-	0555	rm
__pycache__/	-	0555	rm
account-review	799	0555	edit dl rm
allfw	6259	0555	edit dl rm
alp.py	16553	0555	edit dl rm
autossl_sync	6267	0555	edit dl rm
check_apache	9205	0555	edit dl rm
check_bandwidth	4546	0555	edit dl rm
check_boxtrapper	1684	0555	edit dl rm
check_cpu	12212	0555	edit dl rm
check_crons	1827	0555	edit dl rm
check_dcpumon	1973	0555	edit dl rm
check_dns	1827	0555	edit dl rm
check_domlogs	61	0555	edit dl rm
check_exim	3731	0555	edit dl rm
check_hacks	22604	0555	edit dl rm
check_imap	5249	0555	edit dl rm
check_io	6635	0555	edit dl rm
check_max_children	16341	0555	edit dl rm
check_mem	1660	0555	edit dl rm
check_misc	1510	0555	edit dl rm
check_pacct	5201	0555	edit dl rm
check_php	4344	0555	edit dl rm
check_pop3	2295	0555	edit dl rm
check_prov.py	4714	0555	edit dl rm
check_server	696	0555	edit dl rm
check_size	490	0555	edit dl rm
check_software	9849	0555	edit dl rm
check_spamd	2426	0555	edit dl rm
check_traffic	1933	0555	edit dl rm
check_user	1887	0555	edit dl rm
clean_exim.py	6390	0555	edit dl rm
clusterfix	5343	0555	edit dl rm
cmspass.py	3970	0555	edit dl rm
cms_check.py	9825	0555	edit dl rm
cms_counter.py	36734	0555	edit dl rm
cms_creds	713	0555	edit dl rm
cms_dumpdb	4485	0555	edit dl rm
cms_pw	1416	0555	edit dl rm
cpanel-api	7040	0555	edit dl rm
cpanel_postgres_manager.py	29004	0555	edit dl rm
cpmerge	4631	0555	edit dl rm
cpumon	2195	0555	edit dl rm
dcpumon.pl	1239	0555	edit dl rm
dedcheck	18127	0555	edit dl rm
dns-sync	14386	0555	edit dl rm
docroot.py	4425	0555	edit dl rm
du-tree	7450	0555	edit dl rm
envinfo.py	6633	0555	edit dl rm
exclude_rbl.py	5249	0555	edit dl rm
extract-vhost	2691	0555	edit dl rm
filescan	3566	0555	edit dl rm
find_warez	1460	0555	edit dl rm
first_setup.py	19120	0555	edit dl rm
fixwpcron.py	4822	0555	edit dl rm
fix_dns_cluster	353	0555	edit dl rm
goaccess	1217720	0555	edit dl rm
hostsfilemods	4467	0555	edit dl rm
imap_io	2323	0555	edit dl rm
innodb_converter.py	9343	0555	edit dl rm
killall911	530	0555	edit dl rm
killdns	941	0555	edit dl rm
lastcommcache.sh	1374	0555	edit dl rm
legal_lock_down.sh	7450	0555	edit dl rm
lil-cpanel	52002	0555	edit dl rm
listacct	4575	0555	edit dl rm
mailscan	4544	0555	edit dl rm
mail_sources.py	7407	0555	edit dl rm
megaclisas-status	38664	0555	edit dl rm
migrate2central.sh	14418	0555	edit dl rm
modify-account	40631	0555	edit dl rm
modsec_disable.py	11461	0555	edit dl rm
monarxctl	8912	0555	edit dl rm
msp.pl	27714	0555	edit dl rm
mysql_dstat	474	0555	edit dl rm
mysql_selector.py	73102	0555	edit dl rm
nlp	4582	0555	edit dl rm
procscrape	1863	0555	edit dl rm
quarantine	11083	0555	edit dl rm
radsfunctions.sh	863	0555	edit dl rm
recent-cp	16148	0555	edit dl rm
remote_dump	18347	0555	edit dl rm
reset_cpanel	3205	0555	edit dl rm
server-load	2192	0555	edit dl rm
show-conns	20105	0555	edit dl rm
show-conns-adv.py	54667	0555	edit dl rm
sparta.py	382498	0555	edit dl rm
sqltop	27129	0555	edit dl rm
telcheck	2411	0555	edit dl rm
temprootreset	186	0555	edit dl rm
unsuspend_user	1307	0555	edit dl rm
unsusprunner.sh	1840	0555	edit dl rm
updatednsadmin	526	0555	edit dl rm
update_spf	14972	0555	edit dl rm
upgrade-check	9216	0555	edit dl rm
vhost_data.py	6221	0555	edit dl rm
wp-xray.sh	85816	0555	edit dl rm

Edit: /opt/dedrads/check_imap (5249B)

#!/bin/bash

LINESDEF="120000";
LINES=$LINESDEF
if [ $# -eq 3 ] && [ "$2" == "--lines" ];
then
        LINES=$3;
        #echo $LINES;
fi

if [ -f "/var/log/maillog" ]; then
    MAIL_LOG="/var/log/maillog"
elif [ -f "/var/log/mail.log" ]; then
    MAIL_LOG="/var/log/mail.log"
fi

#echo $LINES
function printUsage () {
	echo "This script will check $MAIL_LOG and active running processes for imap related activity."

echo =Check Mailbox Usage Info=
	echo;echo "$0 --topio"
	echo "Will show a list of emails with bytes sent and received"

echo;echo "$0 --userconns"
	echo "Show a sorted list of active imap processes per user";echo;

echo;echo "$0 --mailbox"
	echo "Show a sorted list of active imap processes, sorted per mailbox";echo;

echo;echo "$0 --mboxsize"
	echo "Show the size of the mailbox for all connected accounts.";
	echo "(could drive the load and take some time - use with care)";echo;

echo;echo "$0 --user <username>"
        echo "Shows a list of logins per hour, mailbox sizes and utilization for one user";echo;

echo =Check Basic Login Info=
        echo;echo "$0 --login_email"
        echo "Prints the email addresses with the most logins.";echo;

echo;echo "$0 --login_ip"
        echo "Prints the IP addresses with the most logins.";echo;

echo;echo "$0 --login_failed"
        echo "Prints highest number of failed logins by IP, address, and the both Address and IP.";echo;

echo;echo "$0 --option --lines NUMLINES"
        echo "This will execute the option, checking NUMLINES back throgh the log file (default is ${LINESDEF})"

echo;echo "$0 --checkerror";
	echo "Checks to see if you are hitting the maximum number allowed connections";
	echo "(Use this if you get complaints of pop timing out or being slow to connect!)";

echo;echo "$0 --help"
	echo "You're looking at it!"
}
case $1 in
--topio)
	tail -${LINES-45000} $MAIL_LOG |awk '
	/LOGOUT/ && /imapd/ && /user=/{

gsub(/rcvd=/,"",$11);
	 gsub(/sent=/,"",$12);
	 rcvd[$7]=rcvd[$7]+$11
	 sent[$7]=sent[$7]+$12
	}
	/LOGOUT/ && /pop3d/ && /user=/{
	 gsub(/sent=/,"",$13);
	 gsub(/rcvd=/,"",$12);
	 sent[$7]=sent[$7]+$13
	 rcvd[$7]=rcvd[$7]+$12

}
	END{
			for (key in sent) {
					printf "%-80s %-10s %-10s\n",key,sent[key],rcvd[key];
			}
	}'
	;;
--userconns)
	ps auwx | grep imapd | awk '{if ($1 ~ /[a-z]+[0-9]+/){print $1}; }' | sort | uniq -c | sort -nk1
	;;

--mailbox)
	ps auwx | grep imapd | awk '{if ($1 ~ /[a-z]+[0-9]+/){print $12}; }'  | sort |uniq -c | sort -nk1
	;;

--mboxsize)
	echo "this may take awhile - hit control-C to exit at any time"
	for account in $(ps axuw |
                         grep "/usr/lib/courier-imap/bin/imapd /home/" |
                         grep -v root | awk '{ print $12 }'|sort | uniq);
		do
			du -h --max-depth=0 $account/cur;
		done
	;;
--login_ip)
        tail -${LINES-45000} $MAIL_LOG | grep imapd | awk '{print $8}' | sed -e '/^$/d' | sort | uniq -c | sort -nk1
        ;;

--login_email)
        tail -${LINES-45000} $MAIL_LOG | grep imapd | awk '/LOGIN/{print $7}' | sort | uniq -c | sort -nk1 | tail -2
        ;;

--login_failed)
        echo "=Sorted by IP="
        tail -${LINES-45000} $MAIL_LOG | grep imapd |awk '/LOGIN FAILED/{print $9 }' | sort | uniq -c | sort -nk1 | tail -15
        echo "=Sorted by Address="
        tail -${LINES-45000} $MAIL_LOG | grep imapd | awk '/LOGIN FAILED/{print $8 }' | sort | uniq -c | sort -nk1 | tail -15
        echo "=Sorted by Address and IP="
        tail -${LINES-45000} $MAIL_LOG | grep imapd | awk '/LOGIN FAILED/{print $8, $9}' | sort | uniq -c | sort -nk1 | tail -15
        ;;
--checkerror)
	tail -${LINES-45000} $MAIL_LOG |grep "maximum active connections";
	;;
--user)

IMAPUSER=$2
function IMAP_INBOX_MAIL() {
#Mail log lengh in hours =
START_D=$(date +%s --date="`head -1 $MAIL_LOG |awk '{print $1,$2, $3}'`"); \
END_D=$(date +%s --date="`tail -1 $MAIL_LOG |awk '{print $1, $2,$3}'`"); \
LOG_TIME=$(echo $END_D $START_D |awk '{print ($1-$2)/60/60}' |cut -d'.' -f1)

#User homedir =
HOMEDIR=$(grep $IMAPUSER /etc/passwd |awk -F':' '{print $6}')

paste \
<(for i in $(cat $HOMEDIR/etc/*/passwd |awk -F':' '{print $6}' |awk -F'mail/' '{print $2}' |grep [a-z] |awk -F'/' '{print $2"@"$1}'); \
do echo $i "`grep $i $MAIL_LOG |grep IMAP |grep LOGIN |wc -l`" |awk -v LTIME=${LOG_TIME} '{ if ($2>0) print $1, $2/LTIME" logins per hour :: " }'; \
done) \
<(IMAP_USERS=$(for i in $(cat $HOMEDIR/etc/*/passwd |awk -F':' '{print $6}' |awk -F 'mail/' '{print $2}' |grep [a-z] |awk -F'/' '{print $2"@"$1}'); \
do echo $i "`grep $i $MAIL_LOG |grep IMAP |grep LOGIN|wc -l`" |awk '{ if ($2>0) print }'; done); \
for i in $(printf "$IMAP_USERS\n" |awk '{print $1}'); \
do NAME=$(echo $i |cut -d'@' -f1); \
DOMAIN=$(echo $i |cut -d'@' -f2); \
IMAPUSER_MAILDIR=$(cat $HOMEDIR/etc/$DOMAIN/passwd |grep $NAME |tail -1 |awk -F':' '{print $6}' |grep [a-z]); \
echo "`ls $IMAPUSER_MAILDIR/cur/ |wc -l` emails `du -sh $IMAPUSER_MAILDIR/cur/ |awk '{print $1}'` inbox ::" \
"`find $IMAPUSER_MAILDIR/ -type f |wc -l` emails `du -sh $IMAPUSER_MAILDIR/ |awk '{print $1}'` total"; done) \
|awk '{ if ($7>0) print }' | sort -rnk7 |column -t
}

IMAP_INBOX_MAIL 2>/dev/null
;;
--help)
	printUsage;
	exit 0
	;;
*)
	printUsage;
	exit 1
	;;
esac

cmd: