X-Git-Url: https://git.exim.org/exim.git/blobdiff_plain/37f8a7c915237d565e252f91c047ca88e3b84ab8..bc338899110ea22098559081f77cbd0f7a8044bd:/src/src/eximstats.src

diff --git a/src/src/eximstats.src b/src/src/eximstats.src
index dcc26c8a0..66777c9ee 100644
--- a/src/src/eximstats.src
+++ b/src/src/eximstats.src
@@ -1,7 +1,6 @@
 #!PERL_COMMAND -w
-# $Cambridge: exim/src/src/eximstats.src,v 1.17 2007/09/21 08:26:48 steve Exp $
 
-# Copyright (c) 2001 University of Cambridge.
+# Copyright (c) 2001-2013 University of Cambridge.
 # See the file NOTICE for conditions of use and distribution.
 
 # Perl script to generate statistics from one or more Exim log files.
@@ -282,6 +281,11 @@
 # 2007-09-20  V1.59 Steve Campbell
 #             Added the -bylocaldomain option
 #
+# 2007-09-20  V1.60 Heiko Schlittermann
+#             Fix for misinterpreted log lines
+#
+# 2013-01-14  V1.61 Steve Campbell
+#             Watch out for senders sending "HELO [IpAddr]"
 #
 #
 # For documentation on the logfile format, see
@@ -386,7 +390,7 @@ Useful for finding out which of your mailing lists are receiving mail.
 
 Show the delivery times (B<DT>)for all the messages.
 
-Exim must have been configured to use the +delivery_time logging option
+Exim must have been configured to use the +deliver_time logging option
 for this option to work.
 
 I<list> is an optional list of times. Eg -show_dt1,2,4,8 will show
@@ -537,7 +541,7 @@ mailing list exim-users@exim.org.
 This program does not perfectly handle messages whose received
 and delivered log lines are in different files, which can happen
 when you have multiple mail servers and a message cannot be
-immeadiately delivered. Fixing this could be tricky...
+immediately delivered. Fixing this could be tricky...
 
 Merging of xls files is not (yet) possible. Be free to implement :)
 
@@ -580,7 +584,7 @@ use vars qw($WEEK $DAY $HOUR $MINUTE);
 
 @days_per_month = (0, 31, 59, 90, 120, 151, 181, 212, 243, 273, 304, 334);
 $gig     = 1024 * 1024 * 1024;
-$VERSION = '1.59';
+$VERSION = '1.61';
 
 # How much space do we allow for the Hosts/Domains/Emails/Edomains column headers?
 $COLUMN_WIDTHS = 8;
@@ -1922,7 +1926,13 @@ sub generate_parser {
     # "H=Host (UnverifiedHost) [IpAddr]" or "H=(UnverifiedHost) [IpAddr]".
     # We do 2 separate matches to keep the matches simple and fast.
     # Host is local unless otherwise specified.
-    $ip = (/\\bH=.*?(\\[[^]]+\\])/) ? $1 : "local";
+    # Watch out for "H=([IpAddr])" in case they send "[IpAddr]" as their HELO!
+    $ip = (/\\bH=(?:|.*? )(\\[[^]]+\\])/) ? $1
+     # 2008-03-31 06:25:22 Connection from [213.246.33.217]:39456 refused: too many connections from that IP address // .hs
+     : (/Connection from (\[\S+\])/) ? $1
+     # 2008-03-31 06:52:40 SMTP call from mail.cacoshrf.com (ccsd02.ccsd.local) [69.24.118.229]:4511 dropped: too many nonmail commands (last was "RSET") // .hs
+     : (/SMTP call from .*?(\[\S+\])/) ? $1
+     : "local";
     $host = (/\\bH=(\\S+)/) ? $1 : "local";
 
     $domain = "localdomain";  #Domain is localdomain unless otherwise specified.
@@ -2359,6 +2369,7 @@ sub generate_parser {
         # 2005-09-23 15:07:49 1EInHJ-0007Ex-Au H=(a.b.c) [10.0.0.1] F=<> rejected after DATA: This message contains a virus: (Eicar-Test-Signature) please scan your system.
         # 2005-10-06 10:50:07 1ENRS3-0000Nr-Kt => blackhole (DATA ACL discarded recipients): This message contains a virus: (Worm.SomeFool.P) please scan your system.
         / rejected after DATA: (.*)/ ||
+        / (rejected DATA: .*)/ ||
         /.DATA ACL discarded recipients.: (.*)/ ||
         /rejected after DATA: (unqualified address not permitted)/ ||
         /(VRFY rejected)/ ||
@@ -2417,6 +2428,14 @@ sub generate_parser {
         ++$rejected_count_by_reason{"\u$1$2"};
         ++$rejected_count_by_ip{$ip};
       }
+      elsif (
+        # 2008-03-31 06:25:22 H=mail.densitron.com [216.70.140.224]:45386 temporarily rejected connection in "connect" ACL: too fast reconnects // .hs
+        # 2008-03-31 06:25:22 H=mail.densitron.com [216.70.140.224]:45386 temporarily rejected connection in "connect" ACL // .hs
+        /(temporarily rejected connection in .*?ACL:?.*)/
+        ) {
+        ++$temporarily_rejected_count_by_ip{$ip};
+        ++$temporarily_rejected_count_by_reason{"\u$1"};
+      }
       else {
         ++$rejected_count_by_reason{Unknown};
         ++$rejected_count_by_ip{$ip};