Byteplant Forum

Home » CleanMail Support » CleanMail Server Talk » report of Spam by email address
report of Spam by email address [message #1045] Tue, 22 February 2005 11:12
clarke-pj
Messages: 5
Registered: February 2005
Junior Member
We have a number of users on our domain who are part of multiple groups and some of these users are getting 3-400 spam mails a day.

I would like to be able to see which of the groups are receiving the most spam mails so that I can handle the worst offenders differently.

Is there a report available to show the number of spam mails per smtp address?
Or has anyone been able to generate a report like this from the log files?

Thanks
Peter Clarke
Re: report of Spam by email address [message #1046 is a reply to message #1045] Wed, 23 February 2005 21:48 Go to previous message
themarcel
Messages: 2
Registered: February 2005
Junior Member
Here is a little VB-script I wrote to Parse the log file that is generated by NOSPAMTODAY v1.2.5.2

This is for v1.2.5.2 but could easily be modified for the current version of No Spam Today.

Code is a little rough but it does the job.

http://www.twinsburgh.com/nospamtoday/

I then import these into MS Excel and create pivot tables to get counts for each of the three parsed logs. Sort by high count. I then add top known offenders from FROM and HELO/EHLO lists by adding them to my local.cf file.

Marcel

Re: report of Spam by email address [message #1047 is a reply to message #1046] Thu, 24 February 2005 11:32 Go to previous message
clarke-pj
Messages: 5
Registered: February 2005
Junior Member
Thanks for that marcel, it makes very interesting reading.

What I was actually looking for though was the number of spam per mailbox, rather than the number of mails.
However I would say that they should map pretty closely together.

Also I'm using 2.0.3.1 and it seems to work fine.

Peter
Re: report of Spam by email address [message #1048 is a reply to message #1045] Thu, 24 February 2005 18:25 Go to previous message
themarcel
Messages: 2
Registered: February 2005
Junior Member
"As per the spam per mail box" - I was thinking the same thing.

i.e. Who gets the most SPAM and which person in my organization is receiving it.

I just haven't had the chance to spend some time on adding the additional code.

I will repost code when I get that done.

Marcel
Re: report of Spam by email address [message #1049 is a reply to message #1048] Sat, 11 February 2006 17:50 Go to previous message
Kpauley
Messages: 7
Registered: February 2006
Junior Member
This code is not available anymore on that website it looks like.

I am looking for a SPAM/HAM p/user email address report. I an trying to use a SpamAssassain log parser on the nospamtoday.log file but so far I am not having much luck.

Does anyone have a reporting tool like this for NST? I'd like to be able to look at this data before I purchase so I can get my email addresses trimmed down (trying to get it to under 10).

Ken
Re: report of Spam by email address [message #1050 is a reply to message #1045] Sun, 12 February 2006 20:19 Go to previous message
Heidner
Messages: 121
Registered: February 2005
Senior Member
I wrote a tool that is in the NST third party contribution area.

http://www.byteplant.com/support/nospamtoday/contrib.html

The tool spamlogs reads the NST logfiles and builds a line that can either be read by we humans, or saved as a comma separated variable file (csv). You then import the csv file into a spreadsheet , sort by group receiving the most, the spammer sending the most, etc.

The information written for each e-mail includes (but not limited to), status (accept/reject), spam assassin score, timestamps, sender, receiver, subject, etc.

I break the report down and send a list of rejected e-mails to each receipient (small network) so they can see what was rejected. I also look at the scores and the biggest senders to decide if I want to block domains.
Re: report of Spam by email address [message #1051 is a reply to message #1050] Mon, 10 April 2006 22:33 Go to previous message
RandallRash
Messages: 23
Registered: March 2005
Junior Member
If I run SPAMLOGS with no options it scrools a list of e-mail info on the screen as expected. But if I enter SPAMLOGS --csv I get "Can't open Spamlogs for reading:No such file or directory at spamlogs.pl line 64". What am I missing? Thanks for your help.
Re: report of Spam by email address [message #1052 is a reply to message #1051] Mon, 10 April 2006 22:37 Go to previous message
RandallRash
Messages: 23
Registered: March 2005
Junior Member
Oh, just got it: -csv=filename
Re: report of Spam by email address [message #1053 is a reply to message #1052] Thu, 13 April 2006 23:21 Go to previous message
Heidner
Messages: 121
Registered: February 2005
Senior Member
For some of the heavy e-mail users (or administrators) you might also just want to send an e-mail report of the rejected mails. I do that with script that looks like:

del dennis.txt
spamlogs.exe --file="nospamtoday.log" --rcpt=dennis --score=9 --remark="delete" --days=1 > dennis.txt
if %errorlevel% GTR 0 e:\bork\exchange\mapisend.exe -u username -p password -r "Dennis Heidner" -s "Deleted e-mail log" -m "Deleted e-mail log for Dennis included" -v -f "Dennis.txt"

mapisend was available on the MS Backoffice resource CD's. There are other ways to also send mail back into your server... that is... mapisend .exe isn't your only choice.

The spamlogs options I used were to select only e-mails that were deleted, in the last 24 hours, and had a score of 9 (your threshold might vary).

You could repeat the spamlogs extraction step multiple times -- each time it would append the info to the text file... this way you could look at email being rejected for a group of people.
Re: report of Spam by email address [message #1054 is a reply to message #1050] Tue, 24 October 2006 18:09 Go to previous message
thisbejoe7
Messages: 17
Registered: January 2006
Junior Member
Anyone else have problems running this? I execute the program from the command line and it creates my output csv file but its always 0kb. I don't see any output in the dos box as it runs either even without arguments. My log files are over 70MB and more lines than excel can handle. Any others having this problem?

Thanks...
Re: report of Spam by email address [message #1055 is a reply to message #1045] Sat, 28 October 2006 06:59 Go to previous message
Heidner
Messages: 121
Registered: February 2005
Senior Member
Joe, I know you got it going... we've been corresponding. But I think I will include your observation that spamlogs wants both the logfile that ends with ".log" and ".log~". Plus detailed logging must be enabled.
Previous Topic: Timed out -> recv failed
Next Topic: Proxy settings
Goto Forum:
  


Current Time: Mon Sep 26 02:13:42 CEST 2016