1#@!#!123s

: / opt / dedrads /
Filename : check_spamd
back
#!/bin/bash

LINESDEF="900000"
MAIL_LOG="/var/log/maillog";
if [ ! -f $MAIL_LOG ]; then
	echo "Can't find $MAIL_LOG - bailing."
	exit 1;
fi

function separatorbar {
        echo "========================================================================================="
}


function printUsage () {
	echo;echo "$0"
	echo "	Shows the username, number of scans, and average scantime from /var/log/maillog, sorted by number of messages scanned (default is 900000 lines back)"
	echo;echo "$0 --lines NUM_LINES"
	echo "	Shows the username, number of scans, and average scantime from the last NUM_LINES of /var/log/maillog"
}

function avgspamd () {
        #by volume (number of times appearing in the log
	tail -${LINES:-$LINESDEF} $MAIL_LOG |
	grep "spamd: result: " |
        grep size= | grep user= |
        awk '{print $12, $13, $14, $15, $16}' |
        awk -F "," '{print $1, $2, $3, $4, $5}' | sort -k 3 | awk '{print $3}' | sort | uniq -c | sort -nk1 |
        awk '{users+=1;total+=$1}END{print "Average scans per account: " total/users}'
}

function  tot_avgspamd () {
	#Hackish, but works.
	NEW_DATA=$(
	tail -${LINES:-$LINESDEF} $MAIL_LOG |
	awk '!/^ +$/ && /spamd: result: / && /size=/ && /user=/{print $12, $13, $14, $15, $16}' |
		awk -F "," '{gsub(/scantime|user/,"",$0);
			      gsub(/=/," ",$0);
				if ($3 != "root" && $3 != "") {
					usercount[$3]++;
					userscan[$3]+=$1;
				}
			     }
				END{

					for (key in userscan) {
					if (usercount[key] > 0) { print key," - ",usercount[key]," - ",userscan[key]/usercount[key] }
					else { print key,"null set"}
					}
			}' | sort -nk3
	)
	echo "$NEW_DATA" | awk '
	BEGIN {
			print "Username - Scans - Average";
	}
	!/Username|root/ {
			print $0;
			servercount+=$3;
			serverscan+=$5;
			total++;
	}
	END{
			print "\n";
			if ( total > 0){
				print "Avg Account Scan Time: ", serverscan/total;
				print "Server Average : ", servercount/total;
			}
	}'
}

function check_time () {
	START=$(tail -${LINES:-900000} $MAIL_LOG | head -1|awk '{print $1,$2,$3}')
	END=$(tail -${LINES:-900000} $MAIL_LOG | tail -1|awk '{print $1,$2,$3}')
	echo "Logs from $START to $END";
}

if [ $# -gt 0 ];
then
	case $1 in
	--lines)
		LINES=$2;

		tot_avgspamd
		check_time
		#avgspamd
		;;
	--help) printUsage; exit;;
	*) printUsage; exit 1;;
	esac
else

	#replaced a lot of junk with a series of awkings.  should be con'd to perl
	tot_avgspamd
	check_time
	#avgspamd
fi