haraka / haraka-plugin-log-reader

extracts matching log entries from haraka log files
https://www.npmjs.com/package/haraka-plugin-log-reader
MIT License
2 stars 3 forks source link

improve presentation of log results #6

Open msimerson opened 8 years ago

msimerson commented 8 years ago

Currently, results are very lightly formatted and presented like this:

[NOTICE] [core] connect ip=198.2.131.176 port=23221 local_ip=172.16.15.9 local_port=25
[INFO] [karma] score: 0, good: 0, bad: 3, connections: 3, history: -3
[INFO] [connect.p0f] os="Linux 3.1-3.10" link_type="Ethernet or modem" distance=5 total_conn=1
[INFO] [connect.fcrdns] ip=198.2.131.176 rdns="mail176.atl121.mcsv.net" rdns_len=1 fcrdns="mail176.atl121.mcsv.net" fcrdns_len=1 other_ips_len=0 invalid_tlds=0 generic_rdns=true
[INFO] [geoip] NA, US, GA, Atlanta, 1146km
[INFO] [dnsbl] 
[INFO] [asn] asn: 14782, org: The Rocket Science Group, LLC, asn_score: -2499, asn_connections: 3142, asn_good: 17, asn_bad: 2516, fail:karma
[INFO] [spf] identity=helo ip=198.2.131.176 domain="mail176.atl121.mcsv.net" mfrom= result=Pass
[INFO] [spf] scope: helo, result: Pass, domain: mail176.atl121.mcsv.net
[INFO] [1] [spf] identity=mfrom ip=198.2.131.176 domain="mail176.atl121.mcsv.net" mfrom= result=Pass
[INFO] [1] [spf] scope: mfrom, result: Pass, domain: mail176.atl121.mcsv.net
[INFO] [1] [rcpt_to.qmail_deliverable] not local
[NOTICE] [1] [core] sender  code=CONT msg=""
[INFO] [1] [core] hook=rcpt plugin=rcpt_to.in_host_list function=hook_rcpt params="" retval=OK msg=""
[NOTICE] [1] [core] recipient  code=OK msg="" sender="bounce-mc.us1_211145.621861-Bross=****.com@mail176.atl121.mcsv.net"
[INFO] [1] [geoip] received=198.2.131.176 country=US
[INFO] [1] [data.headers] fail:from_match(mcsv.net / bevnet.com), pass:duplicate, missing, invalid_date, Return-Path, UA(MailChimp Ma), direct-to-mx(2)
[INFO] [1] [avg] time=7ms code=200 response="ok"
[INFO] [1] [clamd] pass:clean
[INFO] [1] [rspamd] is_spam: false, is_skipped: false, score: 4.399999, required_score: 15, action: greylist, REPLYTO_EXCESS_QP: 1.199999, RCVD_IN_DNSWL_NONE: 0, DMARC_NA: 0, RWL_MAILSPIKE_VERYGOOD: 0, FORGED_SENDER_VERP_SRS: 0, HTML_SHORT_LINK_IMG_2: 1, URIBL_GREY: 1.5, R_DKIM_ALLOW: -0.2, MIME_GOOD: -0.1, FROM_EXCESS_QP: 1.199999, R_SPF_ALLOW: -0.2, messages: (SPF): spf allow
[INFO] [1] [spamassassin] status=No, score=-3.3, required=5.0, reject=0, tests="BAYES_00,DCC_CHECK,DKIM_SIGNED,DKIM_VALID,\r
[INFO] [1] [dkim_verify] identity="newsletter=3Dbevnet.com@mail176.atl121.mcsv.net" domain="mail176.atl121.mcsv.net" selector="k1" result=pass 
[NOTICE] [1] [core] message mid="<825b4147990be48e684835ac227642b4903.20161111170638@mail176.atl121.mcsv.net>" size=14357 rcpts=1/0/0 delay=7.989 code=CONT msg=""
[INFO] [1] [queue/smtp_forward] forwarding to 24.173.6.187:25
[INFO] [1] [core] hook=queue plugin=queue/smtp_forward function=hook_queue params="" retval=OK msg="2.6.0 <825b4147990be48e684835ac227642b4903.20161111170638@mail176.atl121.mcsv.net> [InternalId=112918985179157, Hostname=WIN-EXCH01.*****.local] Queued mail for delivery"
[NOTICE] [1] [core] queue code=OK msg="2.6.0 <825b4147990be48e684835ac227642b4903.20161111170638@mail176.atl121.mcsv.net> [InternalId=112918985179157, Hostname=WIN-EXCH01.*****.local] Queued mail for delivery (458F0DBF-D276-4DF8-9900-0AE2880E6D20.1)"
[INFO] [1] [karma] score: -1, good: 0, bad: 3, connections: 3, history: -3, awards: 004,021,131,181,231,251,252
[INFO] [1] [karma] score: -1, good: 0, bad: 3, connections: 3, history: -3, awards: 004,021,131,181,231,251,252
[NOTICE] [1] [core] disconnect ip=198.2.131.176 rdns="mail176.atl121.mcsv.net" helo="mail176.atl121.mcsv.net" relay=N early=N esmtp=Y tls=N pipe=Y errors=0 txns=1 rcpts=1/0/0 msgs=1/0/0 bytes=14357 lr="" time=15.725

This can be improved by: