The Community Forums

Interact with an entire community of cPanel & WHM users!
  1. This site uses cookies. By continuing to use this site, you are agreeing to our use of cookies. Learn More.

How to parse your RBL Logs

Discussion in 'General Discussion' started by wzd, Jan 6, 2007.

  1. wzd

    wzd Well-Known Member

    Joined:
    Dec 16, 2005
    Messages:
    118
    Likes Received:
    0
    Trophy Points:
    16
    Location:
    South Africa
    cPanel Access Level:
    Root Administrator
    H all,

    I've created a simple SED script that extracts and parses rejected messages from the /var/log/exim/rejectlog

    - This is useful after you've followed the following tutorial:
    http://www.webhostgear.com/175.html

    - This can be used for monitoring and clients can select email From which they would like to whitelist.

    Code:
    #!/bin/sh
    # Script to Parse Exim Rejected logs (After already parsing)
    #
    sed 's/^\([^ ]*\).*F=<\([^>]*\)> rejected RCPT <\([^>]*\)>/Date: \1\
    From: \2\
    Recipient: \3\
    Reason/' file.name.to.parse
    
    
    You can use the following if you have GNU SED which can parse \n

    Code:
    sed 's/^\([^ ]*\).*F=<\([^>]*\)> rejected RCPT <\([^>]*\)>/Date: \1\nFrom: \2\nRecipient: \3\nRejected/' extract.log > final.log
    Additionally if you want email account specific parsing you can do the following

    Code:
    cat /var/log/exim/rejectlog |grep emailaddress@domain.com > extract.log
    You can then replace "file.name.to.parse" with extract.log

    chmod +x the script file and then execute as following

    Code:
    ./script > final.log
    - I guess there are easier ways to do this and i'm open to suggestions. Let me know if anyone gets anything!

    RESULT:

    From seeing this in your reject log:

    2007-01-06 11:37:19 H=088156096067.stk.vectranet.pl [88.156.96.67] F=<notwichitaeagletip@wichitaeagle.com> rejected RCPT <user@domain.com>: Message rejected because 088156096067.stk.vectranet.pl [88.156.96.67] is blacklisted at bl.spamcop.net see Blocked - see http://www.spamcop.net/bl.shtml?88.156.96.67 :

    You will now see this:

    From: notwichitaeagletip@wichitaeagle.com
    Recipient: user@domain.com
    Reason: Message rejected because 088156096067.stk.vectranet.pl [88.156.96.67] is blacklisted at bl.spamcop.net see Blocked - see http://www.spamcop.net/bl.shtml?88.156.96.67 :


    Side Note: I'm still unable to obtain a linebreak after Reason so that each of the entries are seperated in the final parsed file... (Any suggestions appreciated)

    Marko
     
Loading...

Share This Page