search

darold / sendmailanalyzer

Sendmail log Analyzer is a tool to monitor sendmail usage and generate HTML and graph reports. It reports all you ever wanted to know about email trafic on your network. You can also use it in ISP environment with per domain and per mailbox report.
http://sendmailanalyzer.darold.net/
GNU General Public License v3.0
76 stars 13 forks source link

Amavis Passed Spam show results #61

Closed enekux closed 4 years ago

enekux commented 6 years ago

Hi,

it would be great that when we click under "Amavis/Amavis Passed Spam" and the report is opened in a new tab, a new column would show the results given by SpamAssassin (the part in BLACK in the next example).

For example:

Jun 27 14:03:00 goban.uni-mb.si /usr/sbin/amavisd-new[20776]: (20776-02) spam-tag, bounce-mc.us6_14140971.619185-x.y=domain.com@mail101.sea21.rsgsv.net -> x.y@domain.com, Yes, score=9.781 tagged_above=-999 required=6.31 tests=[AV:SecuriteInfo.com.Spam-3953.UNOFFICIAL=10, BAYES_00=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, FROM_AND_TO_IS_SAME_DOMAIN=0.01, FROM_IS_REPLY_TO=-0.5, HEADER_FROM_DIFFERENT_DOMAINS=0.25, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_IADB_DK=-0.095, RCVD_IN_IADB_LISTED=-0.001, RCVD_IN_IADB_RDNS=-0.235, RCVD_IN_IADB_SENDERID=-0.001, RCVD_IN_IADB_SPF=-0.059, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001, T_DKIMWL_WL_MED=-0.01, URIBL_GREY=0.424] autolearn=ham autolearn_force=no

I see that currently for amavis events collection you parse next lines:

Jun 27 14:03:00 goban.uni-mb.si /usr/sbin/amavisd-new[20776]: (20776-02) Passed SPAMMY {RelayedTaggedInbound}, [148.105.12.101]:60365 [148.105.12.101] bounce-mc.us6_14140971.619185-x.y=domain.com@mail101.sea21.rsgsv.net -> x.y@domain.com, Queue-ID: 144F31E300, Message-ID: 45e89ca775b0e1cfa11515f07.0d8a6f1aef.20180627120120.9144321af8.f0f20a48@mail101.sea21.rsgsv.net, mail_id: QC2eJaJg19W2, Hits: 9.781, size: 113501, queued_as: BEB9B1D79E, dkim_sd=k1:mail101.sea21.rsgsv.net, 4543 ms

And we get this in data file:

140300:144F31E300:amavis:9.781:::Amavis Passed Spam

You would have to grab the "amavis-id" (20776-02) and correlate it with "spam-tag" from the logs to get to the results...

What do you think? Is it feasible?

Thank you and regards,

Eneko

darold commented 5 years ago

@enekux please can you check that the pull request from @biji correspond to what you were looking for and let us know?