search

glenpp / cacti-uloganalyser

Cacti Templates, data collection with Universal Loganalyser and plugins via SNMP
GNU General Public License v2.0
5 stars 4 forks source link

Support ClamSMTP #2

Closed jangrewe closed 7 years ago

jangrewe commented 7 years ago

Hi, thanks for your scripts, i've been using them for years! =)

I had a look at them again today because i upgraded my Cacti, and i noticed that you added OpenDKIM and ClamAV support - but ClamAV only via milter.

Could you add support for ClamSMTP? An example log message would look like this (the rest should be pretty identical to clamav-milter, i guess)

Feb  5 21:12:06 hades clamsmtpd: 10000D: from=emailcheck-robot@ct.de, to=jan@faked.org, status=VIRUS:Eicar-Test-Signature
glenpp commented 7 years ago

I've put your example log line in my test data and tweaked clamav.pm to parse this. Might not be perfect, but see if that does the job.

Personally I've been reducing my usage of AV (this is an attack surface area), so don't have as much options to test. Any feedback welcome.

jangrewe commented 7 years ago

Oh, totally forgot about this one. Maybe someone else benefits from it now, but i switched to clamav-milter later on... found a taste for those milters after having to abandon DSPAM and switching back to SpamAssassin via spamass-milter (and OpenDKIM & OpenDMARC). It's true that AV is basically snakeoil, but if it keeps the occasional crap away (not that i remember the last time i actually received something), i'm happy to put up with it ;-)