#21 Log number of BL hits

[Robert Keurentjes]

Hi Wayne,

I wonder if you would please consider logging the
number of hits per DNSBL, to enable us to evaluate the
effectiveness of each Black List.

I realise that this is a little more complicated, now that
you are using weighted scores to block. So if an email
gets rejected based on 2 DNSBLs, perhaps you could
add 0.5 to both BL counters.

I would very much like to monitor these counters in real-
time, so it would be ideal if you could send this
information to the Syslog device, so that I could use my
own Syslog daemon to display the counters or even alert
me on a specific treshold. I find it useful to monitor
these hits regularly, in particular after adding a new
DNSBL.

I would also like to suggest adding these numbers to the
daily report.

I hope this make any sense.

Best regards,
Robert

[Wayne McDougall]

Logged In: YES
user_id=660239

1. My feeling is rather than multiplying by the weights, we
simply record the number of hits. One can then multiply by
the weigting if one feels so inclined.

2. By hit I assume each time a DNSBL returns a positive
response to an IP query.

3. The daily report already returns a moving average of hits
for each DNSBL. I'm not convinced any more information is
useful. The hits for the current day = todays' count - 0.8 *
yesterday's count.

[Wayne McDougall]

Logged In: YES
user_id=660239

I should also add that a DNSBL hit isn't counted if we get a
match against an entry already blacklisted from an earlier
DNSBL hit recorded in our connection cache.

And you can also count each use of the DNSBL to block an IP
by checking the log for entries like this one:

Block IP 80.65.120.89 ip120-89.introweb.nl bl.spamcop.net

although when a weight is sued, only the last, straw-that-
breaks-the-camels-back DNSBK is listed.

I have addedlogging of DNSBL hits (when we do a lookup) at
log l;evel 7, debug log level 4, asnd it will be in the next 1.4.x
release.