[Mimedefang] greylisting stats

[David F. Skoll]

On Wed, 10 Dec 2003, Tyler wrote:

>  If I get a count from the greylist database for triads (sender, recip,
> IP) that have only been sent once, that will give me a rough idea of the
> number of emails thwarted from greylisting, but doesn't necessarily mean
> that they were all spam.  There could be valid, mis-configured email
> servers in there, servers that haven't resent, etc and this will throw
> off the numbers.

Modify the code to store the date/time of last transmission as well as
the sender/recip/IP triple.

Then any triple that was only sent once, and is older than about 24 hours,
was almost certainly a spam attempt.

You want to store the date/time in the DB anyway so you can periodically
clean it.  A triple that hasn't been seen in 30 days or so should probably
be removed.

Regards,

David.