Usage

Command line usage:

Postfix SASL

Example executing processor postfix-sasl:

$ loganom postfix-sasl -c config.ini -l logfile

It’s optional executing an external script when an anomaly is found:

$ loganom postfix-sasl -c config.ini -l logfile -e /path/script.sh

Note

External scripts can be used with any processor.

Quota High

Example executing processor quota-high:

$ loganom quota-high -c config.ini -l logfile

These parameters can be used in this processor:

-q QUOTA_MESSAGE, --quota-message QUOTA_MESSAGE
                        Quota reject message used in the mail server (default:
                        'Quota per hour exceeded') [Processor quota-high]
--quota-limit QUOTA_LIMIT
                        Quota limit occurrences, above this it will be
                        considered an anomaly (default: 150) [Processor quota-
                        high]

Example changing both parameters:

$ loganom quota-high -c config.ini -l logfile \
--quota-message "quota exceeded" \
--quota-limit 50

Sample execution

With Debug

$ LOGLEVEL=DEBUG loganom postfix-sasl -c config.ini -l logfile
DEBUG:      Starting validating configuration file...
[postfix-sasl]
DEBUG:      Starting "postfix-sasl"
DEBUG:      Log file: logfile
DEBUG:      Start log reading...
DEBUG:      user@domain - 92.36.X.Y
DEBUG:      user@domain - 176.63.X.Y
[...]
DEBUG:      user@domain - 188.69.X.Y
DEBUG:      End log reading...
DEBUG:      Start processing the dictionary...
DEBUG:      user@domain (6)
DEBUG:      Start processing email: user@domain
DEBUG:        IP: 209.85.X.Y - Reverse: mail-ej1-f52.google.com.
DEBUG:          mail-ej1-f52.google.com. skipped by google
DEBUG:        IP: 52.125.X.Y - Reverse: unknown
DEBUG:      Starting new HTTP connection (1): ipinfo.io:80
DEBUG:        Contry: US
DEBUG:          AS8075 Microsoft Corporation skipped by AS8075
[...]

E-mail address: user@domain
  92.36.X.Y - BA - Bihać - unknown - AS9146 BH Telecom d.d. Sarajevo
  176.63.X.Y - HU - Maklár - catv-Y-X-195-207.catv.broadband.hu. - AS6830 Liberty Global B.V.
  195.242.X.Y - UA - Chernihiv - unknown - AS34355 Chernigivtelecom LLC
  188.76.X.Y - ES - Collado-Villalba - Y.X.76.188.dynamic.jazztel.es. - AS12479 Orange Espagne SA
  87.116.X.Y - RS - Belgrade - unknown - AS31042 Serbia BroadBand-Srpske Kablovske mreze d.o.o.
  188.69.X.Y - LT - Vilnius - md-Y-X-195-171.omni.lt. - AS8764 Telia Lietuva, AB

Script with logtail and virtualenv

#!/bin/sh

LOG_LEVEL="DEBUG"  #DEBUG/INFO
CONFIG_INI="~/.loganom-config.ini"
LOG_READ="/var/log/maillog-loganom"
LOG_OUT="/var/log/loganom.log"

logtail /var/log/maillog > "$LOG_READ"

source ~/.venv/loganom/bin/activate

env LOGLEVEL="$LOG_LEVEL" \
    loganom postfix-sasl \
    -c "$CONFIG_INI" \
    -l "$LOG_READ" > "$LOG_OUT" 2>&1
RET=$?

:> "$LOG_READ"

exit $RET

If you want to execute loganom for instance, in every hour, you can use logtail to get just the log lines that weren’t processed yet, this will avoid reprocessing all log.

Command line options

$ loganom --help
usage: main.py [-h] [-c CONFIG] [-l LOG] [-e EXEC] [-q QUOTA_MESSAGE]
            [--quota-limit QUOTA_LIMIT]
            {postfix-sasl,quota-high,foo}

positional arguments:
{postfix-sasl,quota-high,foo}

optional arguments:
-h, --help            show this help message and exit
-c CONFIG, --config CONFIG
                        Path for configuration file (default: ./config.ini)
-l LOG, --log LOG     Path for log file (default: /var/log/maillog)
-e EXEC, --exec EXEC  External script to be executed when an anomaly is
                        found
-q QUOTA_MESSAGE, --quota-message QUOTA_MESSAGE
                        Quota reject message used in the mail server (default:
                        'Quota per hour exceeded') [Processor quota-high]
--quota-limit QUOTA_LIMIT
                        Quota limit occurrences, above this it will be
                        considered an anomaly (default: 150) [Processor quota-
                        high]