[mailed and posted]
On Fri, 26 Jan 2001, Marc MERLIN wrote:
> I'm trying to understand where the gig of mail (when I usually only
> see 3 to 400MB) came from and went to. I see a source for 100MB, but
> nothing that adds up to a 1G+ (I mean, I do see local, but that
> doesn't help me).
>
> As you guessed, I want to find out what's happening and teach the culprits
> about other fine protocols like ftp and http :-)
> Top 50 sending hosts by volume
> ------------------------------
>
> 93 104239445 (mail1.synnex.com)
Well that site has an average of about 1M per message.
> 9 21061348 dhcp-net10-32-sw2-203.sndg.valinux.com
And they are sending about 2M per message.
> Top 50 destinations by volume
> -----------------------------
> 3 9455484 mail-uunet.ecrix.com
Well. That is 3M per message.
> 1 9436888 mailhost.worksta.com
I think you can do the math in your head.
> 1 8955808 mail.flyinglogo.com
Likewise.
> Top 50 local destinations by volume
> -----------------------------------
>
> 29 99267405 gbandak
That user gets an average of 3M per message.
Keep going down the list. Then use of perl or awk will help you find the
volume in and out for particular suspect users.
But an easier way is to just set the message size limit to 2M and see who
screems.
-j
PS: I'm not sure of the appropriateness of posting all of that traffic
info about your users. But I assume that you considered that.
--
Jeffrey Goldberg
I have recently moved, see
http://www.goldmark.org/jeff/contact.html
Relativism is the triumph of authority over truth, convention over justice
