Re: [exim] X-Spam-Report for Clean messages

Páxina inicial
Borrar esta mensaxe
Responder a esta mensaxe
Autor: W B Hacker
Data:  
Para: exim users
Asunto: Re: [exim] X-Spam-Report for Clean messages
Gordon wrote:
> I have a need for more detail in my log. We are using exim as an
> inbound relay and pre-filtering before delivering to our mail system.
>
> The reject.log file is very useful but would be more helpful if it had
> CLEAN messages logged also. Now obviously CLEAN messages should not be
> part of reject.log so the best solution would be a log just for
> X-Spam-Report (SPAM and CLEAN)
>
> Searching for these terms is pretty rough since they are in so many conf
> files uploaded....
>
> --snip--
> warn   add_header = X-Spam-Score: $spam_score ($spam_bar)\n\
>             X-Spam-Report: $spam_report
> deny    condition = ${if >{$spam_score_int}{90} {1}}
>             message   = Your message was RejecteD as Spam
> accept
> --snip--

>
> I know log size will increase, but I do not expect the logs to grow more
> than %33 considering yesterday we
> rejected 167,000 Unknown User
> rejected 133,000 spam
> and
> delivered 91,000 messages
>
>
>
>


Not a problem. You have a number of available tools, some seldom used:

1) log_selector =

lets you activate or supress various 'built-in' details - listed in docs.

2) log_message =

activates when an acl triggers

3) logwrite =

activates when an acl is traversed - triggered or not

4) adding a specifier as to *which* log, as in the use of :panic: below

    logwrite  = :panic:,VRL,$sender_host_address,$tod_epoch


Lets you put things into the log *you* choose, even if contrarian to
inbuilt log assignment.

N.B.

In a 'healthy' Exim environment, the 'panic' log is the least used,
hence not a bad place to do custom writes for cron'ed 'harvesting'.

Other options include writes to other-than the bespoke logfiles or to
SQL DB's, as in:

set acl_c19 = ${lookup pgsql{INSERT into ... <whatever>


SQL brings its own set of overhead & 'challenges', responsibility to
admin - but can be read-from or written-to from *anywhere* in Exim -
main section thru acl's thru router/transport sets.

HTH,

Bill