RV Products Forums > Want to record the IP of every message rejected, please help.

Full Version: Want to record the IP of every message rejected, please help.

RV Products Forums > Server-Wide Spam and Virus Protection > General

Sergio

Mar 20 2006, 11:32 AM

Hi,

sorry to bother you with this...

What do I need to add or modify in the script, in order for it to write the IP (just the IP) of every message that got over the score that I set? But I will like that the IP could be recorded in a new file called "exim_scoredIP" and it will be better if the IP is written as many times as it was rejected.

Is it possible?

By the way, what is faster? to check for the score of every message or to check the IP Blacklist file?

Thanks a lot for this wonderful script.

Regards,
Sergio

pairote

Mar 20 2006, 12:31 PM

Try my proposed solution here:
http://forums.cpanel.net/showpost.php?p=233776&postcount=2

I have implemented on my servers. It works well but I cannot justify if it save CPU load. You may try and please report your result here. Is it save the CPU load?

Sergio

Mar 20 2006, 10:36 PM

QUOTE(pairote @ Mar 19 2006, 11:31 PM)

Hi Pairote,
wow, your solution looks great but my VPS is not a powerful one, and that is why I wanted to implement a kind of manual solution.

What I was looking for is to have a list of all the IPs rejected because of the score I set in my VPS, I have been monitoring my rejectlog and had blocked some IPs, but will like to have a file like the rejectlog but only with the IP of the accounts rejected because of the score.

I modified the antivirusandspam.exim file and added this two lines:

CODE

# If you want to bounce message, comment 2 lines below and uncomment the line b$
    logfile /var/log/exim_mainlog
    logwrite "$tod_log $message_id ** F=${lc:$sender_address} [$sender_host_add$
[b]    logfile /var/log/exim_scoreIP
    logwrite "$sender_host_address($1)"[/b]
# Bounce it, but

But doing this I didn?t record what is listed in my REJECTLOG file only what is recorded at exim_mainlog.

I have looked at the ACL in exim configuration but couldn?t find what to modify or add for this to work.

Please help.

Regards,
Sergio

Sergio

Mar 22 2006, 12:14 AM

Right now, the modification to the script is working great. I am getting the IPs of some spammers including the score like this:
222.148.73.204(11.0)
so I know if add it to my BlackList IPs or not.

Also, I am downloading a copy of the file "exim_rejectlog" and I am tabulating the IPs, so far so good. I have added a lot of recurrent IPs into my rv_blacklist_IP hoping this will decrease the server functions of SpamAssasin.

Regards,

Sergio

This is a "lo-fi" version of our main content. To view the full version with more information, formatting and images, please click here.