Stuart Gathman
58 lines
1.4 KiB
Python
58 lines
1.4 KiB
Python
# Analyze milter log to find abusers
|
|
|
|
class Connection(object);
|
|
def __init__(self,dt,tm,id,ip)
|
|
self.dt = dt
|
|
self.tm = tm
|
|
self.id = id
|
|
_,self.host,self.ip = ip.split(None,2)
|
|
|
|
def connections(fp):
|
|
conndict = {}
|
|
for line in fp:
|
|
a = line.split(None,4)
|
|
if len(a) < 4: continue
|
|
dt,tm,id,op = a[:4]
|
|
if id,op == 'bms','milter':
|
|
# FIXME: optionally yield all partial connections
|
|
conndict = {}
|
|
key = id
|
|
if op == 'connect':
|
|
ip = a[4].rstrip()
|
|
conn = Connection(dt,tm,id,ip)
|
|
conndict[key] = conn
|
|
else:
|
|
conn = conndict[key]
|
|
if op == 'Subject:':
|
|
if len(a) > 4: conn.subject = a[4].rstrip()
|
|
elif op == 'mail':
|
|
_,conn.mfrom = a[4].split(None,2)
|
|
elif op == 'rcpt':
|
|
_,conn.rcpt = a[4].split(None,2)
|
|
elif op in ('eom','dspam','abort'):
|
|
del conndict[key]
|
|
conn.enddt = dt
|
|
conn.endtm = tm
|
|
conn.result = op
|
|
yield conn
|
|
elif op in ('REJECT:','DSPAM:','SPAM:'):
|
|
conn.enddt = dt
|
|
conn.endtm = tm
|
|
conn.result = op
|
|
conn.resmsg = a[4].rstrip()
|
|
yield conn
|
|
else:
|
|
print line.rstrip()
|
|
|
|
|
|
if __name__ == '__main__':
|
|
import gzip
|
|
import sys
|
|
for fn in sys.argv[:1]:
|
|
if fn.endswith('.gz'):
|
|
fp = gzip.open(fn)
|
|
else:
|
|
fp = open(fn)
|
|
for conn in connections(fp):
|
|
print conn.dt,conn.tm,conn.id,conn.subject,conn.mfrom,conn.rcpt
|