About / News Features Download Documentation Support Contact ScreenShots Help support SendmailAnalyzer!
|
SendmailAnalyzer configurationThe default path to configuration file is /etc/sendmailanalyzer.conf If you want to change this path, please edit cgi-bin/sa_report.cgi and sa_cache to match you're need. For sendmailanalyzer use the --config|-c command line argument. The configuration file consist in a text file with a configuration option in upper case and a value or list of value separated by a tab character. Here are the definition of all this configuration directives. System commands optionsTAIL_PROGPath to the system tail command. Can be overwritten with --tail or -t in sendmailanalyzer args. Default is /usr/bin/tail. TAIL_ARGSCommand line argument passed to the tail system command. Can be overwritten with --args or -a in sendmailanalyzer args. Default is -n 0 -f. ZCAT_PROGPath to zcat system command used to parse compressed log file. Can be overwritten with --zcat or -z in sendmailanalyzer args. Default is /usr/bin/zcat. FREE_SPACESelect the freeing space method for data files older than the current month. The value can be: - delete: definitively remove all data files. - archive: make a gzipped tarball of data files before deleting them. - none: don't do anything. Need lot of space disk. Default is archive. JOURNALCTL_CMDUse it to set the journalctl command to use instead of log file entry. For example, with postfix it migth be set to the following: JOURNALCTL_CMD journalctl -u postfix and for sendmail: JOURNALCTL_CMD journalctl -u sendmail When enabled, the LOG_FILE configuration directive above is just ommitted. The additional option: --output="short-iso" is also always used to format timestamp. In incremental mode sendmailanalyzer will automatically set the --since option to the last parsed timestamp to prevent loading previous messages. Note that in daemon mode sendmailanalyzer will automatically add the -f option to the command. Can be overwritten with --journalctl or -j options. Input/output optionsLOG_FILEPath to the maillog file to analyse. Can be overwritten with --log or -l in sendmailanalyzer args. Default is /var/log/maillog. If the extension is .gz SendmailAnalyzer will automatically use zcat to parse the compressed log. OUT_DIROutput directory for data storage. Can be overwritten with --output or -o in sendmailanalyzer args. The directory must exist, being writable by the user running sendmailanalyzer and sa_cache. It must be readable by the http user for CGI script sa_report.cgi. Default is /var/www/sendmailanalyzer DEBUGTurn on/off debug/verbose output mode. Can be overwritten with --debug or -d in sendmailanalyzer args. Default is 0, disable. DELAYDelay in second to flush collected data to disk. Can be overwritten with --write-delay or -w in sendmailanalyzer args. Default is 60 seconds. During this time data are kept in memory to limit disk I/O and gain speed. If you experience an out of memory on huge mail server adjust this value to something smaller depending of your hardware configuration. Reporting/display optionsERROR_CODEPath to SMTP error code file (relative to CGI directory) where sa_report.cgi is running. Default: lang/ERROR_CODE. LANGPath to the translation file (relative to CGI directory) where sa_report.cgi is running. Default: lang/en_US. HTML_CHARSETUsed to define the HTML charset to use. Default is iso-8859-1, but with cyrillics character for example you will have to use utf-8 instead. TTFONTTrue type font to use in graphs. When using Bulgarian langage for example, GD::Graph is unable to draw Cyrillics font without a true type font. You can also use it with other langage, this must be the full path to the ttf file. For example: TTFONT /usr/share/fonts/truetype/msttcorefonts/arial.ttf to use Arial. URL_LOGOUrl to the barorng image. Default: salogo.gif URL_JSCRIPTUrl to the flotr2 javascript library. Default: flotr2.js URL_SORTABLEUrl to the sorttable javascript library. Default: sorttable.js TOPNumber of object displayed in the top statistics. Default is 25. TOP_MBOXNumber of object displayed in the top email addresses statistics. Default is 25. MAX_RCPTMax number of recipients per message where senders will be reported. Default 25 recipients max. MAX_SIZEMax size in bytes per message where senders will be reported. Default is 10000000. MAX_LINEMax lines to show in detail view. Default is 100. SIZE_UNITSize Unit to use, default is Bytes. Other values are KBytes and MBytes. DOMAIN_REPORTCompute statistics and cache for a list of domain and display a link in the front page for a per domain access. See DOMAIN_USER if you want to grant special access on these pages. You can have multiple DOMAIN_REPORT lines. If you are running rsyslog with multiple host use DOMAIN_HOST_REPORT instead. Example: DOMAIN_REPORT domain1.com,domain2.com DOMAIN_HOST_REPORTCompute statistics and cache for the given host followed by a list of domain and display a link in the front page for a per domain access under each host. You can have multiple DOMAIN_HOST_REPORT lines. See DOMAIN_USER if you want to grant special access on these pages. For example: DOMAIN_HOST_REPORT host1 domain1.com,domain2.com DOMAIN_HOST_REPORT host2 domain2.com,domain3.com ANONYMIZEThis option allow the anonymization of the output, i-e it remove any sender/recipient personal information from the report. REPLACE_HOSTThis option replace some hostname in all relay information for anonymization You must used one REPLACE_HOST line per replacement. REPLACE_HOST internal.relay.dom external.relay.dom SPAM_VIEWEnable/Disable menu links to Spam views. Default show it: 1 VIRUS_VIEWEnable/Disable menu links to Virus views. Default show it: 1 DSN_VIEWEnable/Disable menu links to Notification views. Default show it: 1 POSTGREY_VIEWEnable/Disable menu links to Postgrey usage views. Default show it: 1 SHOW_DIRECTIONEnable/Disable messaging/spam/virus/dsn direction statistics. Default is show. On some mailhost this could show wrong information if the direction could not be easily determined. So you can remove these views by setting it to 0. SPAM_TOOLSList of antispam name separated by a comma used for Spam details view. You may want to custom this list to just show menu link on available reports. Default list is: spamdmilter,jchkmail,dnsbl,spamassassin,amavis,mimedefang,dnsblmilter,spamd Feel free to remove those you're not using to not see link to empty report in the menu. SHOW_DIRECTIONEnable/Disable messaging/spam/virus/dsn direction statistics. Default is show. On some mailhost this could show wrong information if the direction could not be easily determined. So you can remove these views by setting it to 0. SHOW_SUBJECTWhen enabled it allow email subjects to be shown in detailed view. Of course the log file must contain this information. Default is disabled. Maillog parsing optionsFULLParse maillog from begining before running tail program. Can be overwritten with --full or -f in sendmailanalyzer args. Default is 0, jump at the end of log. Most of the time you may want to enable this to jump at the last parsed line during the previous run. FORCEParse maillog from the begining before running the tail program but force sendmailanalyzer to never use the LAST_PARSED file. Can be overwritten with command line option --force or -F. BREAKDo not run tail program and exit after a full parsing of the log file. Can be overwritten with --break or -b in sendmailanalyzer args. Default is 0, go ahead with tail. MTA_NAMESyslog name of the MTA. Syslog write it to maillog with the pid as ... sendmail[1234] ... This is required to only parse relevant lines. Can be overwritten with --sendmail or -s in sendmailanalyzer args. Default is sendmail, some distro come with sm-mta instead. Some other have multiple names (ex: sm-mta, sendmail and sm-msp-queue) in this case you can set the value of this directive to a pipe separated list of values, for example: sm-mta|sendmail|sm-msp-queue. Default: sm-mta|sendmail MAILSCAN_NAMESyslog name of MailScanner. Syslog write it to maillog with the pid as ... MailScanner[1234] ... This is required to only parse relevant lines Can be overwritten with --mailscanner or -m in sendmailanalyzer args. Default is MailScanner. AMAVIS_NAMESyslog name of Amavis. Syslog write it to maillog with the pid as ... amavis[1234] ... This is required to only parse relevant lines. Default is amavis. MD_NAMESyslog name of MimeDefang. Syslog write it to maillog with the pid as ... mimedefang.pl[1234] ... This is required to only parse relevant lines based on parsing mimedefang log generated by method md_graphdefang_log() Default is mimedefang.pl. CLAMD_NAMESyslog name of Clamd. When using Mailscanner with clamd if you want virus report you must configure clamd to log with syslog and use LOG_MAIL. Default value is 'clamd' (... clamd[1234] ...) Can be overwritten with --clamd or -n CLAMSMTPD_NAMESyslog name of clamsmtpd. Default value is 'clamsmtpd' (... clamsmtpd: ...). POSTGREY_NAMESyslog name of Postgrey. Syslog write it to maillog with the pid as follow: ... postgrey[1234] ... This is required to only parse relevant logged lines Can be overwritten with --postgrey or -g. Default is postgrey SPAMD_NAMESyslog name of Spamd. Syslog writes it to maillog with the pid as follow: ... spamd[1234] ... This is required to only parse relevant logged lines Can be overwritten with --spamd. Default is spamd. LOCAL_DOMAINComa separated list of internal domain to be used when SendmailAnalyzer is running on a mail host which received message from any side. SA can't know what message are internal or external in this case, so the only way to know if a mail come from Internet or Lan/Wan is to check the domain part of the relay sender address. You can have multiple LOCAL_DOMAIN lines for better reading. For example: LOCAL_DOMAIN domain1.com,domain2.com,... LOCAL_DOMAIN domain3.com LOCAL_DOMAIN domain4.com LOCAL_HOST_DOMAINSame as above but with host distinction for use with rsyslog. You can have multiple LOCAL_HOST_DOMAIN lines, ie: one per host. For example: LOCAL_HOST_DOMAIN sysloghost1 domain1.com,domain2.com LOCAL_HOST_DOMAIN sysloghost2 domain3.com,domain4.com MAIL_HUBFQDN coma separated list of internal mail hubs, aka: where email are redirected if the host is a gateway. For example: mailhost.mydom.dom This directive is very important to help SendmailAnalyzer to find the direction of incoming and outgoing message. MAIL_GWFQDN coma separated list of MTA gateways where external mail comes from. This directive is very important to help SendmailAnalyzer to find the direction of incoming and outgoing message. DEFAULT_DOMAINDefault domain or hostname to add to an email address if there's just the username. When the host is a delivery system it is possible that the user email address do not have the domain part (ex: @domain.com). By default SendmailAnalyzer will add the '@localhost' domain but you may want to change this domain, so use this directive SPAM_DETAILThis directive allow report for Spam details. Enable by default. This allow you to see complete detail of your favorite antispam as well as score, cache hit and autolearn if your antispam report it. To disable set it to 0, you will save disk space. SMTP_AUTHThis directive allow report for SMTP authentication. Enable by default. This allow you to see per authent type (server or client) user and relay statistics. If you not use SMTP Auth set it to 0 to disable this feature. These stats are not available in per domain views. MERGING_HOSTUse this directive to combined multiple mailhost report on a single report. This allow you to aggregate multiple mailhost that syslogs to a remote server throught rsyslog to have only one SendmailAnalyzer report. The value must only use alphanumeric character as it is used to create subdirectory. SKIP_RCPT_RELAYUse this to set the recipient relay used for local delivery if your message appears twice in details view and in messaging, sender and recipient counter. This is especially right with postfix configured to have local delivery via dovecot service. Default: dovecot, that means that recipient log lines with relay=dovecot will instruct sendmailanalyzer to skip those messages. A common value can also be 127.0.0.1 with MTA where the message is first sent locally. EXCLUDE_TOUse this directive to set a pipe separated list of destination email address that should be excluded from the report. They will not be reported into data files too. The value should be a valid regex, the addresses will be search in all destination adresses with $TO =~ /^$EXCLUDE_TO$/. For example: EXCLUDE_TO bcc-addr1\@domain1.com|bcc-addr2\@domain2.com will exclude from report all recipient statistics sent to bcc-addr1@domain1.com and bcc-addr2@domain2.com RELAY_IP_ONLYWhen possible sendmailanalyzer extract the fqdn part of the sender or recipient relay. Enable this directive if you just want Ip addresses. POSTSCREEN_DNSBL_THRESHOLDThreshold to detect case where postscreen reject an ip address. By default "reject: RCPT from ..." are not logged by postfix, we mark the message as DNSBL rejected when DNSBL rank value is upper or equal than this threshold value. Default value: 3 Domain / user views optionsLOW_LIMIT, MEDIUM_LIMIT, HIGH_LIMIT (NO MORE USED)User messaging data limit in megabytes to show/warn the level of mail activity. LOW_LIMIT (3 by default), mail activity under this limit is shown as green. MEDIUM_LIMIT (5 by default), mail activity under this limit is shown as orange. HIGH_LIMIT (10 by default), mail activity under this limit is shown as red. above the hight limit the user is warn for abuse. Set all to 0 if you want to disable this feature. ADMINList of admins username separated by coma that must have full access to all report. The username is checked again the http REMOTE_USER environment variable. Default is every one can access, in this case you may want to add a .htaccess. DOMAIN_USERList of per user domain access control. The first field is the username and the second field (separated by tabulation) is a coma separated list of domain name to be allowed to this user. You could add as many lines of DOMAIN_USER as you want in the configuration file. Access controlAccess control is based on the REMOTE_USER environment variable stored by the httpd server during an htaccess Authentication. If this variable is not set, there is full access for every one. |
---|
Copyright (c) 2002-2019 Gilles Darold - All rights reserved. (GPL v3).