[Mimedefang] virus source report?

[Anne Bennett]

Les Mikesell asks:

> Has anyone come
> up with a clever way to parse the logs or another way to quickly
> notice if the first IP in the received headers belongs to your
> own ranges so that after the scanner detects the virus you can
> quickly find internal boxes already infected?

I make mimedefang log something like:

  Aug  9 00:15:30 courage mimedefang.pl[30635]: i794FMeO030827:
    relay=159.226.211.71, action=discard, detail=virus 'W32/Lovgate-V',
    envfrom=<foobar at msn.com>, envrcpt=<foobar at cs.concordia.ca>, subj=

Then I have a nightly cron job that checks for messages discarded due
to the presence of a virus, and if the relay was on our network, this
gets reported.

I append the logging subroutine I have put in the mimedefang-filter,
which I call for any action that is taken on a message.

Hope that helps a bit.


Anne.
-- 
Ms. Anne Bennett, Senior Sysadmin, ENCS, Concordia University, Montreal H3G 1M8
anne at encs.concordia.ca                                    +1 514 848-2424 x2285
-------------------------------------------------------------------------------

# Create a syslog entry in our own particular format, which our
# reporting tools will understand.  If there is a third parameter, log
# for just that recipient.  The global %Recipients should have been
# set before this is called.
sub concordia_log($$;$)
{
  my ( $action, $detail, $just_this_recip ) = @_;
  #debug_filter("sub concordia_log");

  my ( $qid, $relay, $lcsender, $subj );
  my ( $recip, @recips, $log_subject, $log_each_recip );

  # Do not log subject by default, but only when we think that there's
  # something wrong with the message,
  $log_subject = undef;
  if ( ( $action =~ /^(tag|defang|pre_reject|reject|discard)/ ) &&
       ( $action !~ /debug/ )
     )
  {
    $log_subject = 1;
  }

  # Log for each recipient separately only if we are going to reject
  # or discard the message; otherwise, one log line is plenty!
  $log_each_recip = undef;
  if ( $action =~ /^(reject|discard)/ )
  {
    $log_each_recip = 1;
  }

  # Set up values for logging, avoiding undefined values.

  $qid = $MsgID;
  $qid = "NOQUEUE" unless $qid;
  $qid = "NOQUEUE" if $qid =~ /^<No/ ;

  $relay = $RelayAddr;
  $relay = "UNKNOWN" unless $relay;

  if ( $Sender )
  {
    $lcsender = lc($Sender);
  }
  else
  {
    $lcsender = "NONE";
  }

  @recips = ();
  foreach $recip ( keys %Recipients )
  {
    push @recips, lc($recip);
  }
  unless ( @recips )
  { 
    @recips = ( "NONE" );
  }
  if ( ( scalar(@recips) > 1 ) &&
       ( ! $log_each_recip )
     ) 
  {
    @recips = ( "MULTIPLE" ); 
  }
  if ( $just_this_recip )
  {
    @recips = ( $just_this_recip );
  }
  
  $subj = $Subject;
  $subj = "" unless $subj;
  
  # Issue a log message for each recipient of this message (or for the
  # special recipient "MULTIPLE" if that was set).
  
  foreach $recip ( @recips )
  {
    my ( $message );
  
    $message = 
      sprintf( "%s: relay=%s, action=%s, detail=%s, envfrom=%s, envrcpt=%s",
               $qid, $relay,  $action,   $detail,   $lcsender,  $recip);

    if ( $log_subject )
    {
      $message .= sprintf(", subj=%s", $subj);
    }

    md_syslog("info", $message);
  }
}

-------------------------------------------------------------------------------