[Mimedefang] Graphdefang 0.9 missing events?

[John Kirkland]

Hello, Mark,

I'm suspecting one of the following:

1.  You are having DBFile issues and only seeing the items from the most
recent time you ran graphdefang and not the ones in the SummaryDB file.
This is common on BSD systems.  There's info in my faq about this at
www.bl.org/~jpk/graphdefang

2.  Another possible answer is that the regexp you are using is not
broad enough to catch all 2797 events.  If you were willing to gzip up
your log file and send me your event file, I could troubleshoot this with
you.

3.  Another possible answer is that one of the other reject events is
catching your other log lines.  Graphdefang will only graph the first
match that it finds.  One of the other reject events might be catching
most of the rejects and leaving your custom event with only the few that
you are seeing.  To get around this, rename your custom event so that it
comes alphabetically before the other reject events.

That's all I can think of for this...

Regards,
John Kirkland

On Fri, 31 Oct 2003, Mark wrote:

> Hello,
>
> I just installed graphdefang 0.9 on my FreeBSD 4.7R box. It seems to work
> great, except that it finds way too few items for my own event (a variation
> to "reject"), which tests like so:
>
> if ($text =~ m/^.*?: Milter: from=(\S+), reject=(\d+) (\d\.\d.\d) \
> We accept.*?\[(\d+\.\d+\.\d+\.\d+)\]$/) {
>
> (The wrap is only for this email). The graph says it found 427 items, while
> in actuality there are over 2797! So, either graphdefang is extremely buggy
> (hard to imagine it would be THAT buggy), or $text is not what I think it is
> (a single line from datafile?), or something else I misunderstood.
>
> If anyone has any ideas, I'll gladly hear them. :)
>
> Thanks,
>
> - Mark
>
>
> ------------------------------
>