Re: [exim] re spamming

John Robinson wrote:
> On 22/11/2006 10:37, Deepak Kapoor wrote:
> > On 11/22/06, Ian FREISLICH <if@???> wrote:
> [...]
> >> No, for some reason exim doesn't log the size of rejected mails,
>
> Because usually it can't, it hasn't received the email yet.

I wasn't clear: For some reason exim doesn't log the size of
rejected mails when the message is rejected after data by an ACL.

Also:

When the client (MUA or transmitting MTA) times out the connection
early, exim doesn't log the size recieved so far and then discarded.
I've seen this happen quite often as well.

> >> For cases where the rejection may involve significant bandwidth.
>
> This would be rare and would depend on having a specialised
> configuration which does reject after DATA and doesn't log *anything*
> from the sound of what Deepak's saying.

It's rare enough to be a significant portion of some of our clients'
bandwidth. This specialised configuration you talk of is not in
as wide disuse as I think you suspect it is.

There are many cases where the SMTP connection uses a non-trivial
amount of bandwidth, but no logs to this effect are produced. The
same goes for most other services.

Frankly, I'm surprised that anyone is naive enough to expect that
traffic data gathered from a router using netflow or other flow
acounting protocols will be remotely matched by daemon logs. It's
a non-trivial exercise to get these variegated collection methods
to tally.

Ian

--
Ian Freislich