diff options
Diffstat (limited to 'utils/rspamd_stats.pl')
| -rw-r--r-- | utils/rspamd_stats.pl | 38 |
1 files changed, 29 insertions, 9 deletions
diff --git a/utils/rspamd_stats.pl b/utils/rspamd_stats.pl index f931b365e..9335905a5 100644 --- a/utils/rspamd_stats.pl +++ b/utils/rspamd_stats.pl @@ -8,6 +8,7 @@ use warnings; use strict; my @symbols_search; +my @symbols_exclude; my $reject_score = 15.0; my $junk_score = 6.0; my $diff_alpha = 0.1; @@ -32,6 +33,7 @@ GetOptions( "reject-score|r=f" => \$reject_score, "junk-score|j=f" => \$junk_score, "symbol|s=s@" => \@symbols_search, + "exclude|s=s@" => \@symbols_exclude, "log|l=s" => \$log_file, "alpha|a=f" => \$diff_alpha, "correlations|c" => \$correlations, @@ -208,17 +210,33 @@ sub ProcessLog { next; } + my @symbols = split /(?:\{[^}]*\})?(?:$|,)/, $4; + my $scan_time = $5; + my $act = $1; + my $score = $2 * 1.0; + my $skip = 0; + + foreach my $ex (@symbols_exclude) { + my @found = grep {/^$ex/} @symbols; + + if (scalar(@found) > 0) { + $skip = 1; + last; + } + } + + next if ( $skip != 0 ); + $timeStamp{'end'} = $ts; $timeStamp{'start'} //= $timeStamp{'end'}; - $scanTime{'min'} = $5 - if ( !exists $scanTime{'min'} || $scanTime{'min'} > $5 ); - $scanTime{'max'} = $5 - if ( $scanTime{'max'} < $5 ); - $scanTime{'total'} += $5; + $scanTime{'min'} = $scan_time + if ( !exists $scanTime{'min'} || $scanTime{'min'} > $scan_time ); + $scanTime{'max'} = $scan_time + if ( $scanTime{'max'} < $scan_time ); + $scanTime{'total'} += $scan_time; - $action{$1}++; + $action{$act}++; $total ++; - my $score = $2 * 1.0; if ($score >= $reject_score) { $total_spam ++; @@ -227,8 +245,6 @@ sub ProcessLog { $total_junk ++; } - # Symbols - my @symbols = split /(?:\{[^}]*\})?(?:$|,)/, $4; my @sym_names; foreach my $s (@symbols_search) { @@ -436,6 +452,10 @@ Additionaly print correlation rate for each symbol displayed. This routine calcu Do not process input unless finding the specified regular expression. Useful to skip logs to a certain position. +=item B<--exclude> + +Exclude log lines if certain symbols are fired (e.g. GTUBE). You may specify this option multiple time to skip multiple symbols. + =item B<--start> Select log entries after this time. Format: C<YYYY-MM-DD HH:MM:SS> (can be |