Edit: /opt/dedrads/check_exim (3731B)
#!/bin/bash
LINESDEF="120000"
LINES=$LINESDEF;
MAIL_LOG="/var/log/exim_mainlog";
if [ ! -f $MAIL_LOG ]; then
echo "Can't find $MAIL_LOG - bailing."
exit 1;
fi
function separatorbar {
echo "========================================================================================="
}
function printUsage () {
echo;echo "$0 --status"
echo " Sorts the output of the exiwhat command, giving you total incoming connetions, also gives you top IPs/subnets connecting."
echo "====LOOKING FOR SPAM/UNAPPROVED MAIL FROM SCRIPTS====";
echo " Lists all the dirs where mail has originated from in the last $LINES lines, with timestamps."
echo;echo "$0 --dirtotals"
echo " Lists all the dirs where mail has originated from in the last $LINES lines, sorted and counted."
echo;echo "$0 --listdirs|--dirtotals --lines NUM_LINES"
echo " Same as above, but if the third argument is --lines, you'll be checking NUM_LINES back in the log files."
echo;echo "$0 --queuebysender --lines NUM_LINES"
echo " Show the count of messages in the mail queue by sender."
echo;echo "$0 --queuebybounceback --lines NUM_LINES"
echo " Show a count of who bouncebacks are going to."
echo;echo "$0 --recipientisp"
echo " Show the recipient isp with the most queued."
echo;echo "$0 --recipienttest mail.remoteserver.com"
echo " Test the recipient mail server for connectivity or rejection errors."
echo;echo "$0 --fullmbox "
echo " Show errors about accounts reaching mail quota."
echo
}
function topconns () {
tail -${LINES-$LINEDEF} $MAIL_LOG | awk '/SMTP connection from/{gsub(/.:[0-9]+/,"",$0);gsub(/\[/,"",$0);print $7 }' |sort | uniq -c | sort -nk1
}
function listdirs () {
tail -${LINES-$LINESDEF} $MAIL_LOG | awk '/cwd=.home./{print $1,$2,$4}' | sort -k3;
}
function dirtotals () {
tail -${LINES:-$LINESDEF} $MAIL_LOG | awk '/cwd=.home./{print $4}' | sort | uniq -c | sort -nk1;
}
function queuebysender () {
exim -bp | grep -P "^ *\d+[a-z]\s+" | awk '{print $4}' | sort | uniq -c | sort -nk1
}
# SamuelP 2/16/2012 added a listing for bounceback recipients
function queuebybounceback()
{
exim -bp | grep '<>' | awk '{print $3}' | xargs -i exim -Mvh {} | grep -iE "To:" | awk '{print $3}' | tr '[:upper:]' '[:lower:]' | sort | uniq -c | sort -nk1
}
function recipientisp () {
exim -bp |exiqsumm |sort -nk1
}
function recipienttest () {
echo "testing" | mail -vv -s 'testing connectivity' test@$2
}
function fullmbox () {
tail -${LINES:-$LINESDEF} $MAIL_LOG | grep "mailbox is full " | awk '{print $1,$6}' | sort | uniq -c |sort -nk1
}
function check_time () {
START=$(tail -${LINES:-$LINESDEF} $MAIL_LOG | head -1|awk '{print $1,$2}')
END=$(tail -${LINES:-$LINESDEF} $MAIL_LOG | tail -1|awk '{print $1,$2}')
echo "Logs from $START to $END";
}
if [ $# -eq 3 ] && [ "$2" == "--lines" ];
then
LINES=$3;
#echo $LINES;
fi
case $1 in
--status)
exiwhat | awk -F'from' '{print $1}' | awk '{$1=""; print}' | sort | uniq -c |sort -nk1;
echo "===IPs Connecting==="
exiwhat | awk '$NF ~ /[0-9]*\.[0-9]*\.[0-9]*\./ && /incoming/{gsub(/\[|\]/,"",$NF);print $NF}' | sort | uniq -c | sort -nk1
echo "===Subnets Connecting==="
exiwhat | awk '$NF ~ /[0-9]*\.[0-9]*\.[0-9]*\./ && /incoming/{gsub(/\[|\]/,"",$NF);print $NF}'| sort | uniq |
awk -F. '{print $1"."$2"."$3}' | sort | uniq -c | sort -nk1
;;
--listdirs)
listdirs
check_time
;;
--dirtotals)
dirtotals
check_time
;;
--topconns)
topconns
check_time
;;
--queuebysender)
queuebysender
check_time
;;
--queuebybounceback)
queuebybounceback
check_time
;;
--recipientisp)
recipientisp
;;
--recipienttest)
recipienttest
;;
--fullmbox)
fullmbox
check_time
;;
--help) printUsage; exit;;
*) printUsage; exit 1;;
esac