Daily Message Report

[That Guy from that Place]

Hi,

I'm interested in generating a daily report that displays the number of messages sent per user each day, which will help us identify accounts that may be compromised and spamming.

I thought a simple script that grepped and counted "from=<$username" from the mail logs would work but I've run into a hitch. When a user sends a message, the mta accepts it into the queue, but then requeues it and relays it through the content filter. Since it's queued twice, it shows up as two separate messages in the logs, and simply grepping and counting "from=<$username" returns a misleading value. (Note that spam with the sender address spoofed as someone in the domain will cause this as well).

I modified the script to handle this but it's much too slow. Does anyone have any suggestions on how to accomplish this? I thought I saw that there was a Zimbra command that actually generated these types of reports but I can't seem to find it now.

[phoenix]

The admin account should be receiving a daily report that provides email statistics. Have a look at that job for some ideas about how to generate a new report, it's based on pflogsumm.

[edit]Note that pflogsumm is introduced in the 6.x release of Zimbra but it does work on earlier releases.

[That Guy from that Place]

Thanks phoenix.Turns out these reports were never being mailed because the mailbox server that runs them doesn't have an mta installed. I'm setting up a work around for that, though. Looks like they'll have a lot of useful info in them!