Sendmail & Mailscanner version 2

[pvenezia]

Thanks pvenezia for the fix. Did you manage to see what the unmet dependecies were?

Not really. I started by manually altering the xml file, but there was something really odd going on, so I imported the template and basically reset all the params in the UI, tested and re-exported it.

I've also noted some interesting problems with Cacti recently that cause bizarre RRD errors when there shouldn't be any -- for instance, editing that template while a device was using it caused the graphs to break completely. Removing all changes didn't remedy the issue. Only after deleting all graphs using the template, re-importing a fresh template, editing it identically, then recreating the device graphs worked.

*shrug*

Oh, and by all means, use the code.

[mike_tcis]

Now to what has changed. This version runs significantly differently. There are basically two scripts, a maillog watcher script and a read counters script. Both of these scripts run on your mail server.

Thanks for this script. One very useful addition would be to add a counter for the current queue size -- that is, in /var/log/maillog, look for:

New Batch: Found XX messages waiting

(and put XX into the counter file)

We run 5 high-volume MailScanner boxes and monitoring the current queue size is critical to catch any load-related issues.

--Mike

[warnesj]

One very useful addition would be to add a counter for the current queue size

I'm already doing that in a different way. I didn't include it in this batch of scripts though because I handle it outside MailScanner. The reason I'm doing this outside MailScanner is a long time ago I was having stability problems with MailScanner. MailScanner would die and mail would just start piling up. So if MailScanner died we wouldn't get any "New Batch:" messages to tag off of. So I came up with the way of just counting the messages in the incoming sendmail directory.

Here is an example of my graph.


There is another script that I made to help get this information.
count_mqueue_in.sh Script
This is a script that is stored on the mail server and is called by Net-SNMP (the same way all my other scripts get called) and basically counts all the files in the /var/spool/mqueue.in directory, which is where I spool my incoming mail. My script is stored in /opt, but you can put it anywhere. Just be sure that if you move it that you update your snmpd.conf to point to the new location.
/opt/count_mqueue_in.sh

Code: Select all

#!/bin/sh
echo .1.3.6.1.4.100.1
echo gauge
numfiles=`/bin/ls -l /var/spool/mqueue.in | /usr/bin/wc -l`
half=`expr $numfiles "/" 2`
echo $half
exit

The script taked the total number of files and divides it by 2 to take into account that each messages has a "df" and "qf" file. If your incoming mail directory isn't /var/spool/mqueue.in, just modify the scrip to correct location for you.

Then we need to add stuff to the Net-SNMP configuration file, so that when .1.3.6.1.4.100.1 is queried the script above is run.
snmpd.conf additions

Code: Select all

pass .1.3.6.1.4.100.1 /bin/sh /opt/count_mqueue_in.sh

Cacti Templates
Below are the data template and graph template for this. Once you've imported both of those templates basically all you need to do is,

1. Select your mail server from the Devices menu item in the Cacti console.
2. Add the Sendmail - Number of Queued Messages graph in the Associated Graph Templates section.
3. Click on the Crate Graphs for this Host link at the top of the window.
4. Put a check mark in the Sendmail - Number of Queued Messages option.

That should be it. Now just wait for a couple of polling periods to pass and you should start seeing stuff (if you have any queued mail).

[mike_tcis]

One very useful addition would be to add a counter for the current queue size

I'm already doing that in a different way. I didn't include it in this batch of scripts though because I handle it outside MailScanner. The reason I'm doing this outside MailScanner is a long time ago I was having stability problems with MailScanner. MailScanner would die and mail would just start piling up. So if MailScanner died we wouldn't get any "New Batch:" messages to tag off of. So I came up with the way of just counting the messages in the incoming sendmail directory.

Yes, I can see how that situation would be valid as well. We use exim as our MTA, and most often we have MailScanner start "backing up" for whatever reason, and the queue size as reported by MS starts to grow. I'll see if I can modify you script for exim, but I do still think that adding the MS queue size to the script would be a worthwhile addition. You could also add a counter for the number of SpamAssassin cache hits as well.

--Mike

[raiten]

one note, i can import correctly templates from Wed Sep 06, 2006 12:24 pm . but in graph management, i have nothing linked to the graph and when i try to change it. it is not saved

somebody with what is need in the db to manually insert it ?

thanks

[r_chetanjain]

Hi.... gr8 template....but i am having some issues getting the counters...we are using mimedefrag and some other milters for spam and virus detection with our sendmail.....

For RBLSMTPD :
--------------
Aug 20 04:03:36 mx1 sendmail[32341]: ruleset=check_relay, arg1=[195.116.34.22], arg2=127.0.0.2, relay=sith7.blokowe.pl [195.116.34.22] (may be forged), reject=553 5.3.0 Spam blocked see: http://spamcop.net/bl.shtml?195.116.34.22

For this i tried searching check_relay and reject=553, but it doesn't hit any counters


For VIrus :
-----------
Aug 20 04:03:41 mx1 sendmail[32335]: k7K83VVg032335: Milter: data, reject=554 5.7.1 virus Worm.SomeFool.Gen-1 detected by ClamAV - http://www.clamav.net

For this i tried searching for detected\ by\ ClamAV, but it doesn't hit any counter

Spam
-----

Aug 20 04:04:27 mx1 mimedefang.pl[11433]: MDLOG,k7K84LXX032590,TMGspam,20.774,216.150.2.137,<return-341-hi=i82_xb5x862x_zcx5@yyy.com>,<akantrow@xxx.com>,Congratulations akantrow@xxx.com on your Panasonic 42=?UTF8?Q?=22?= Wide Screen Planel

For this i tried TMGspam, again it doesn't hit any counters....


Can you help in this regard

[ethan]

Hi,

I have problem when importing template. the error message is

Error: XML: Generated with a newer version of Cacti.

but I've already used cacti v0.8.6h
which should be the lasted version and also matched this thread
did I miss something else?

[warnesj]

Sorry for the long wait, I was on holidays for a while.

I do still think that adding the MS queue size to the script would be a worthwhile addition. You could also add a counter for the number of SpamAssassin cache hits as well.

I'll add those counters shortly and post a script update. They should be easy enough to add, I just need to figure out what keywords to tag off of.

one note, i can import correctly templates from Wed Sep 06, 2006 12:24 pm . but in graph management, i have nothing linked to the graph and when i try to change it. it is not saved

If you select your Data Sources from the Cacti console, and then select your mail server to just view it's data sources, are all the watchmaillog data sources showing up? When you add the graph, are the watchmaillog data sources selectable? It's odd that it would let you choose the data sources but not save the settings.

somebody with what is need in the db to manually insert it ?

Telling what stuff to put in the database is probably not going to work because I think the database uses data source id numbers which are automatically generated each time you create a data source. So my numbers will be different than your numbers.

Hi.... gr8 template....but i am having some issues getting the counters...we are using mimedefrag and some other milters for spam and virus detection with our sendmail.....

<cut out for space>

Can you help in this regard

Glad you like the template. I'm not entirely sure why your searches are failing and the counters aren't increasing. If you could send a snipet of the code you're using I might be able to see what's going on. I was thinking, for your RBLSMTPD stuff, try tagging off the reject code you're sending, assuming they're unique. I'd try searching for "reject\=553". So a code issertion might look like,

Code: Select all

   # Look for Sendmail milter SPAM messages
   if($line=~/reject\=553/){
      $item="milter_spam";
      &readcounterfile;
      $counter{$item}++;
      if($debug){print("Milter found a spam message, incrementing the milter_spam counter to $counter{$item}.\n");}
      &writecounterfile;
   }

I'd do something similar for your antivirus milter, look for "reject\=554". As far as your mimedefang goes, I would have done just as you did. Tag off "TMGspam". I'm not sure why it wouldn't be working though. If you wanna share a bit of the code I might be able to help.

Hi,

I have problem when importing template. the error message is

Error: XML: Generated with a newer version of Cacti.

but I've already used cacti v0.8.6h
which should be the lasted version and also matched this thread
did I miss something else?

Strange indeed. It is exported from 0.8.6h. You're absolutely positive, 100%, that you're running 0.8.6h? You can check what your database think's your Cacti version is by running this command,

Code: Select all

mysql -ucactiuser -pcactipass cactidb --execute="SELECT * FROM version;"

But replace cactiuser with the MySQL database username, replace cactipass with your MySQL database password, and replace cactidb with the MySQL database name for your Cacti database. You should get something like this,

Code: Select all

+--------+
| cacti  |
+--------+
| 0.8.6h |
+--------+

[warnesj]

Yes, I can see how that situation would be valid as well. We use exim as our MTA, and most often we have MailScanner start "backing up" for whatever reason, and the queue size as reported by MS starts to grow. I'll see if I can modify you script for exim, but I do still think that adding the MS queue size to the script would be a worthwhile addition. You could also add a counter for the number of SpamAssassin cache hits as well.

--Mike

Hey Mike, I don't have the Basiten filter turned on with my SpamAssassin, can you send me a couple of maillog samples that deal with the cache hits? Thanks. Also I'm testing the other counter of the reported MailScanner queue size. I'll release the code once it's run for a little bit. I don't want to put untested code out there.

[warnesj]

I do still think that adding the MS queue size to the script would be a worthwhile addition.

Ask and you shall recieve. I've updated the 1st main post in the thread with updated script code and a new data and graph template for the MailScanner queue size. I called it MailScanner Messages Waiting, but it's the same thing.

The changes are,

maillog Watcher Script Changes
I added the following section of code,
/opt/watchmaillog/watchmaillog.sh

Code: Select all

        # Look for MailScanner waiting messages
        if($line=~/New\ Batch\:\ Found/){
                $item="mess_waiting";
                $mess_waiting_pos = index($line,"New\ Batch\:\ Found");
                $mess_waiting_pos2 = index($line,"\ messages\ waiting");
                $mess_waiting = substr($line,($mess_waiting_pos+17),($mess_waiting_pos2-($mess_waiting_pos+17)));
                &readcounterfile;
                $counter{$item}=$mess_waiting;
                if($debug){print("Mailscanner found $mess_waiting messages waiting, setting the mess_waiting counter to $counter{$item}.\n");}
                &writecounterfile;
        }

This is added after the code section that looks for viruses detected by MailScanner. If you look at the first post by me you can see where it is. Basically I created a new variabled called mess_waiting that is stored in the same file that all the other variables are stored in. As soon as this code is put into the maillog Watcher Script the mess_waiting variable will be created in the counter file.

Read Counters Script Changes
The only change in the read counters script that changes is that a new SNMP OID is required to read the new value. To do that I added the following code,
/opt/watchmaillog/readcounters.sh

Code: Select all

$oid{"mess_waiting"}=".1.3.6.1.4.100.8";

This code is added near the beginning of the script after all the other OID declarations. Again, if you look at the first post by me you can see where the new code is.

Finally we need to add a new SNMP OID to the Net-SNMP configuration file.
snmpd.conf additions

Code: Select all

pass .1.3.6.1.4.100.8 /opt/watchmaillog/readcounters.sh mess_waiting

This code is added to after the other custom OID's that were created originally. So as you can see, the OID for the mess_waiting value is .1.3.6.1.4.100.8.

New Cacti Templates
I've updated the mail post and attached the new data and graph templates, but I've also included just the new data template and graph template here. If you download this update you'll need to,

1. Import the data and host templates.
2. Add the new data source to the Cacti device for your mail server. This is done using the Data Sources menu item on the console. The new data source is
   • watchmaillog - MailScanner Messages Waiting
3. Then add the watchmaillog - MailScanner Messages Waiting graph to your mail server device. This is done through the Graph Management menut item in the console. Select the watchmaillog - MailScanner Messages Waiting data sources for this graph.

And that should be it. WHEW! That took a bit to explain.

[raiten]

[quote]
If you select your Data Sources from the Cacti console, and then select your mail server to just view it's data sources, are all the watchmaillog data sources showing up? When you add the graph, are the watchmaillog data sources selectable? It's odd that it would let you choose the data sources but not save the settings.
[/quote]

in Management > Data Sources, i have 5 entries in *watchmail* (spam, virus, relay, received, sent).
when i click one, i have the path of rrds.
files exists but seems small (93ko)

when i try to create a new watchmail graph, now, i have 2 entries on 5 which are good, and i can't change it also ...

very strange

[warnesj]

in Management > Data Sources, i have 5 entries in *watchmail* (spam, virus, relay, received, sent).
when i click one, i have the path of rrds.
files exists but seems small (93ko)

Okay that's good. The files are suppose to be 94k, that's normal.

when i try to create a new watchmail graph, now, i have 2 entries on 5 which are good, and i can't change it also ...

very strange

Can you send a screenshot of the entries you have?

Here is how I create a graph for one of my mail servers,

1. Open the Cacti console.
2. Select the Graph Management menu item.
3. On the Filter by host: option, select your mail server.
   
4. Click on the Add link.
   
5. Select the watchmaillog - Sendmail & MailScanner Stats template.
   
6. Click on the Create button.
   
7. Select the graph items as per below,
   • Data Source [mess_recv] = YOUR_SERVER - watchmaillog - Sendmail Messages Received (mess_recv)
   • Data Source [mess_sent] = YOUR_SERVER - watchmaillog - Sendmail Messages Sent (mess_sent)
   • Data Source [spam] = YOUR_SERVER - watchmaillog - MailScanner SPAM (spam)
   • Data Source [viruses] = YOUR_SERVER - watchmaillog - MailScanner Viruses (viruses)
   Don't bother changing the Title of the graph, Cacti will substitute variables so that the graph title looks proper when the graph is displayed.
8. Click on the Save button.
   

You should now see the YOUR_SERVER - E-mail Statistics graph listed with all the other graphs for your server.

And if you click on it you'll go back into selecting the fields for the data sources but you should see an example graph if your existing data sources have data in them.

I hope this helps.

[raiten]

Hi warnesj

i retry today:
delete old entries + data source
create new with graph management > add
select, save





view


only 2 on 6
delete
re import template (downloaded again) and still problem (but only on this one)



check script
re add in graph management
* Msg waiting
PB 3 source only


re import template
same
* Msg Stats
same as before
6 entries (msg_sent twice) all empty
not saved


thanks

note: sorry, i didn't manage to block attachements at the end of the post.

[warnesj]

Okay that's really wierd. For a couple of reasons. First it looks like you may not have all the data templates imported. Can you do me a favor, can you take a screenshot of what you have listed for "watchmaillog -" in your Data Templates from your Cacti console? You should have 6 data templates,

• watchmaillog - MailScanner Messages Waiting (this is a new data template, you may or may not have it)
• watchmaillog - MailScanner SPAM
• watchmaillog - MailScanner Viruses
• watchmaillog - Sendmail Messages Received
• watchmaillog - Sendmail Messages Relayed
• watchmaillog - Sendmail Messages Sent

If you have all those listed then just make sure that all those data sources exist on your mail server. You can verify this by selecting Data Sources from the Cacti console and then select your mail server in the drop-down list for Select a host:. If you can provide a screenshot of what data sources you have for your mail server this may help too.

Second, when you were trying to create the graph I noticed from your screenshot that you have five fields. There should only be four. You have a mess_relay field that isn't suppose to be there. Which graph template did you download? The one from the original post, the one from pvenezia, or a different one? The one from pvenezia and mine should only have four fields to fill in for the E-Mail Statistic graph.

[rbl]

Hmmmm At my site it work almost perfect.
Only the counters are not cleared afther reading the file.
What i meen is that i do not receive many e-mails end for the whole day it is saying 1 message received. It das not set it back to 0 afther 5 min.
What can that be.?