[collectd] Custom plugin for spam statistics

[Florian Forster]

Hi Mirko,

On Thu, Mar 12, 2009 at 11:58:49AM +0100, Mirko Buffoni wrote:
> - qmail log file have timestamp expressed in tai64 format.  Tail
>   plugin should use a timestamp to put data into rrd database, but I
>   think it cannot read tai64 dates (haven't digged source yet, so I
>   may be wrong)

No, the `tail' plugin assumes near-realtime data in the log files.
Parsing dates and times is tricky to say the least. The best we could do
is to pass a submatch to strptime(3). But I currently have no intention
of implementing that. If anyone else wants to, let me know :)

> - how does tail plugin works?  does it rescan the entire log?  if not how
>    does it know how much tail too keep from the log file?

I sincerely hope you didn't think we'd rescan the file every 10 seconds,
did you? I have the `tail' plugin in use with some MTAs that generate
250+ MByte log files per day..

I have described the algorithm in the `tail' plugin in some detail on
the appropriate wiki page, though:
 <http://collectd.org/wiki/index.php/Plugin:Tail#.22Following.22_files>

> - if rescan, shouldn't this overhead too much monitored machine?

Yes; due to spam and virus filtering, mail servers usually are busy
machines. Parsing hundreds of MBytes of log files every few seconds
doesn't precisely improve that situation..

> - I want to build a cumulative graph (like dns queries) with different colors
>    for each spam/virus/legit mail I get.  Can this be done with tail plugin?

Yep, that's possible. See the `Instance' option of the <Match> blocks.

Regards,
-octo
-- 
Florian octo Forster
Hacker in training
GnuPG: 0x91523C3D
http://verplant.org/
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 189 bytes
Desc: Digital signature
Url : http://mailman.verplant.org/pipermail/collectd/attachments/20090313/bd6c37a3/attachment.pgp