Zimbra

claros · #1 (**permalink**) 10-05-2006, 05:00 PM

Hi,
That seemed to me that spam stats, even if displayed, where wrong.
So I used a perl tool to get stats from amavis log and got differents results from the graph displayed in the admin console.
Having a look into the logger database, the amavis table has got only discarded spam and virus and some bad header clean message.
So I've changed line 891 of 1222 of /opt/zimbra/libexec/zmlogprocess from:

if ($msg =~ /$([^)]+)$ (Passed|Blocked) ([^,]+), (?:LOCAL )?\[([^]]+)\] \[([^]]+)\] <([^>]*)> -> (<[^>]+>(?:,<[^>]+>)*),(?: quarantine: [^,]+,)? Message-ID: <([^>]+)>,(?: Resent-Message-ID: <[^>]+>,)? mail_id: \S+, Hits: (\S+), (\d+) ms/) {

to:

if ($msg =~ /$([^)]+)$ (Passed|Blocked) ([^,]+), (?:LOCAL )?\[([^]]+)\] \[([^]]+)\] <([^>]*)> -> (<[^>]+>(?:,<[^>]+>)*),(?: quarantine: [^,]+,)? Message-ID: <([^>]+)>,(?: Resent-Message-ID: <[^>]+>,)? mail_id: \S+, Hits: (\S+),(?: queued_as: [^,]+,)? (\d+) ms/) {

This change includes clean and spammy messages into the amavis table of the logger db. Output of zmlogprocess is found in /tmp and I've no more ERROR lines about "Processing amavis entries from ..."
Actually waiting for spam stats updates, I've not read all the perl code so I don't know how those lines will be processed during amavis log aggregation and graph generation...
Will the logger crash ? :-)

Ciao
Claudio

claros · #2 (**permalink**) 10-06-2006, 06:30 AM

It works very well now, amavis stats are correct.
It may be that in a previus version the queued_as information were not included in the amavis log...
Another hack:
in the line 293 of /opt/zimbra/libexec/zmlogprocess I've changed this query:
$sth = sqlExec("select count(*) from amavis where ".
"host = '".$host."' and ".
"arrive_time >= '".$periodStart."' and ".
"arrive_time <= '".$periodEnd."' and ".
"status = 'SPAM'");

to read:

$sth = sqlExec("select count(*) from amavis where ".
"host = '".$host."' and ".
"arrive_time >= '".$periodStart."' and ".
"arrive_time <= '".$periodEnd."' and ".
"status like 'SPAM%'");

In this way my spam stat includes also SPAMMY messages and I like it..

Ciao