Which mail log analyzer can I use for sendmail? [closed]

Question

I need to analyse my mail log to find out who consumes the most bandwidth (or find out if there is any spam mail send through my server) Which mail log analyser serves the best purpose? FYI, I have copy the logs to my local computer already and the analysing process will have to be done locally. My machine is running on Fedora, but if there is any free and good mail log analyser that runs on Windows, I don't mind to give it a try.

Answer 1

I suggest to use SendmailAnalyzer.

Here is how you can install it on Fedora

First install tool for building RPM packages

yum install rpm-build

Next, download sorces from sourceforge.net

wget "http://downloads.sourceforge.net/project/sa-report/sa-report/8.7/sendmailanalyzer-8.7.tar.gz?r=http%3A%2F%2Fsourceforge.net%2Fprojects%2Fsa-report%2F&ts=1363055890&use_mirror=iweb"

Create work directories

mkdir -p ~/rpmbuild/{SOURCES,SPECS}

Extract spec file from the tarball

tar xf sendmailanalyzer-8.7.tar.gz -C ~/rpmbuild/SPECS --strip-components=3 sendmailanalyzer-8.7/packaging/RPM/sendmailanalyzer.spec

Dive into SPECS folder

cd ~/rpmbuild/SPECS/

And build the package

rpmbuild -bb sendmailanalyzer.spec

Finally you can install it with yum

yum localinstall ~/rpmbuild/RPMS/noarch/sendmailanalyzer-8.7-1.el6.noarch.rpm

Some post installation work to do:

Uncomment the following line in /etc/cron.d/sendmailanalyzer

0 1 * * * root /usr/bin/sa_cache > /dev/null 2>&1

Uncomment the content of /etc/httpd/conf.d/sendmailanalyzer.conf and add place from where you wish to acces the reports (your IP or "all")

Allow from 192.168.1.2

Reload configuration

systemctl reload httpd.service

Start sendmailanalyzer

systemctl start sendmailanalyzer.service

Enable autostart

systemctl enable sendmailanalyzer.service

If you would like to examine the graphs right away you don't need to wait for cron job. Just update the cache manually with

/usr/bin/sa_cache

Answer 2

Installing that MIMEDefang and doing what you want via filter_recipient will give you more measurement flexibility.