OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
 
Subject: Re: extracting smtp traffic from logs
From: Len Conrad (lconradGo2France.com)
Date: Sat Apr 01 2000 - 10:14:46 CST

>So you just want "by-domain-for-time-period" reporting of volume?
>(E.g.: by-domain count and volume out, count and volume in, smtpd
>connect time?)

this, a delimited ascii file with field delimiter of ";" or TAB, with this
as records delimted by cr/lf:

date, time, to:localuser, to:localdomain, from:localuser, from:localdomain,
bytes-transported, in/out.

The field order of course isn't important.

With that, I'll have in the database all I need to determine traffic report
in/out by user, by domain, by period, even report out a "time series" so it
could be fed to MRTG or RRDTool and graphed.

I don't care about to:remote name/domian or from:remote name/domain since I
can't bill the remotes.

My main mail server is Imail (for now, I suppose I'll look at postfix plus
some POP3 server as a replacement for Imilat later), and it outputs its
smtp deliver info with all the above data on one line, so "even" I can hack
out some PERL to extract to an output file, but "veetsy" logs to more than
one line, with other intervening lines, which is way beyond my PERL
capabilities.

Thanks,
Len