Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

It's possible to generate dozens of email reports in a given SMTP environment, and I'm interested in learning what reports are common in large installations and how they are used.

Examples:

  • Messages sent/received per user /day (Check for spam, routing loops with bouncebacks)
  • Bytes sent/received per user / day (Check for abuse, ISOs over email, and data theft)
  • Last message sent / received (Check for unused dormant accounts)
  • Last Logon date (Unused accounts)
  • Relay source IP / User (spam)
  • Failed SMTP authentication attempts (User/Pw brute force)

I read on SO Meta that scoped, finite "list" questions are on topic, and am therefore asking here with the expectation it won't be closed.

Please note: for broad utility, I'm only interested in SMTP-POP3-IMAP reports.

Exchange and AD specific reports are probably best for another question

share|improve this question
    
Technically you're supposed to monitor the postmaster mailbox as well RFC 5321 - 4.5.1 , although that is often more a test to the effectiveness of your spam filtering. –  HBruijn Jun 18 at 14:30
1  
I'm gonna resist the urge to VTC, but I really think this is too broad/unknowable without an indication of what you're interested in. Like, why do want reports? What are you worried about? What email server "things" are of interest to you? –  HopelessN00b Jun 18 at 14:42
    
@HopelessN00b I'm hoping / assuming there is some operational consistency across the various large IT shops the people on this site have been to. That is what I'm interested in; not the site specific/use specific reports that may or may not exist. One thing I didn't list was FeedbackLoop reports, DMARC and more. There are things that apply broadly.... that is what this Q is asking. –  makerofthings7 Jun 18 at 14:46
    
Alright, but I'm not sure what you're looking for - this list of broadly applicable reports - actually exists. We have a great cloud-based spam filter that deals with spam, so we don't care about that. I've put scripts in place on the AD-side to deal with dormant accounts, so we don't care about that. Our Exchange server, however, was setup poorly (for reasons beyond our control), so we care about things that impact resource utilization, however. I imagine that practically everyone has a similar situation - because of environment-specific variables, certain categories matter. Others don't. –  HopelessN00b Jun 18 at 14:56

1 Answer 1

From the operations center point of view, here are couple of metrics that truly matter:

  • Amount of email received/sent per some time period
  • Amount of spam filtered per some period
  • Amount of IP addresses connected to your SMTP server pool
  • Mail queue size at your SMTP servers

From those you can quickly gather an overview if you have some situation going on needing attention, such as a botnet torturing your SMTP servers.

Add those to your monitoring software (such as Nagios, Zabbix, Sitescope), and decide some suitable trigger values for your environment. For example, if you usually receive 1000 e-mails per hour but suddenly the value is 10 000, raise the error flag and let the admin see what's going on.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.