combining exim, spamassassin and clamav analysis over multiple servers (was: Re: exim log analysis)

[Joost van Baal]

On Mon, Aug 22, 2005 at 02:19:50PM +0200, Tom Northeast wrote:
> This is true, but before I can combine and generate statistics, I need
> to add to the exim2dlf converter so that it extracts the spamassassin
> and clamAV messages from the exim log.

You _do_ know there is spamfiltering in Lire, don't you?  If your
spamassassin logfile is rich enough, you might be able to simply drop
the exim log.

If not, you'd have to fiddle with stuff like queue-id or message-id,
present in both exim and spamassassin/clamav logs.  Are these present?

It is possible to extend dlf scheme's.  The www scheme is extended, for
example.  It might be useful while tackling your problem.

Since Lire 2.0, there is support for multiple schema's: more than one
superservice can be featured in a report.  The lire(1) command is the
interface for this.  I've however never used this feature myself.

> I'm currently reading the developer manual and getting up to scratch
> with my perl, so should have some results soon

Cool.

Good luck, Bye,

Joost

-- 
.    .                                        http://logreport.com/
| '.|                        /^LogReport$/
| Lire                                        http://logreport.org/
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 189 bytes
Desc: Digital signature
Url : http://lists.logreport.org/pipermail/questions/attachments/20050822/3dd90209/attachment.bin