Universal Log Analyser/policyd-spf

spf.pm

#!/usr/bin/perl
use strict;
use warnings;
# process the mail log and place the results in a file

# Copyright (C) 2012  Glen Pitt-Pladdy
#
# This program is free software; you can redistribute it and/or
# modify it under the terms of the GNU General Public License
# as published by the Free Software Foundation; either version 2
# of the License, or (at your option) any later version.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program; if not, write to the Free Software
# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
#
#
# See: https://www.pitt-pladdy.com/blog/_20091122-164951%2B0000%20Postfix%20stats%20on%20Cacti%20%28via%20SNMP%29/
#
package spf;
our $VERSION = 20120421;
our $REQULOGANALYSER = 20120420;
#
# Thanks for ideas, unhandled log lines, patches and feedback to:
#
# "oneloveamaru"

sub register {
        my ( $lines, $ends, $uloganalyserver ) = @_;
        push @$lines, \&analyse;
        if ( ! defined $uloganalyserver or $uloganalyserver < $REQULOGANALYSER ) {
                die __FILE__.": FATAL - Requeire uloganalyser version $REQULOGANALYSER or higher\n";
        }
}

our $time = 0;
our $messages = 0;
sub analyse {
        my ( $line, $number, $log, $stats ) = @_;
        my $origline = $line;
        if ( $line !~ s/^.+policyd-spf\[\d+\]+// ) { return; }

                if ( $line =~ s/: SPF None \(No applicable sender policy available\): \s*//i or $line =~ s/: None//i) {
                        ++$$stats{'postfix:policy:policy-spf:none'};
                } elsif ( $line =~ s/: Policy action=PREPEND X-Comment: SPF skipped for whitelisted relay// ) {
                        ++$$stats{'postfix:policy:policy-spf:whitelisted'};
                } elsif ( $line =~ s/: SPF Pass //i or $line =~ s/: Pass//i ) {
                        ++$$stats{'postfix:policy:policy-spf:pass'};
                } elsif ( $line =~ s/: SPF Neutral //i
                        or $line =~ s/: SPF NeutralByDefault //i
                        or $line =~ s/: Neutral//i
                        or $line =~ s/: SPF neutral-by-default //i ) {
                        ++$$stats{'postfix:policy:policy-spf:neutral'};
                } elsif ( $line =~ s/: SPF SoftFail //i or $line =~ s/: SoftFail//i ) {
                        ++$$stats{'postfix:policy:policy-spf:softfail'};
                } elsif ( $line =~ s/: SPF Fail //i or $line =~ s/: Fail//i ) {
                        ++$$stats{'postfix:policy:policy-spf:fail'};
                } elsif ( $line =~ s/: SPF TempError //i or $line =~ s/: TempError//i) {
                        ++$$stats{'postfix:policy:policy-spf:temperror'};
                } elsif ( $line =~ s/: SPF PermError //i or $line =~ s/: PermError//i ) {
                        ++$$stats{'postfix:policy:policy-spf:permerror'};
                } elsif ( $line =~ s/: Policy action=PREPEND X-Comment: SPF skipped for whitelisted relay//
                        or $line =~ s/: Policy action=PREPEND Received-SPF: none //
                        or $line =~ s/: Policy action=PREPEND Received-SPF: neutral //
                        or $line =~ s/: Policy action=PREPEND Received-SPF: pass //
                        or $line =~ s/: Policy action=PREPEND Received-SPF: softfail //
                        or $line =~ s/: Policy action=PREPEND Received-SPF: permerror //
                        or $line =~ s/: Policy action=DEFER_IF_PERMIT //
                        or $line =~ s/: Policy action=DUNNO//
                        or $line =~ s/: Policy action=550 Please see http:\/\/www\.openspf\.org\/Why?//
                        or $line =~ s/handler sender_policy_framework: is decisive\.//
                        or $line =~ s/handler exempt_relay: is decisive\.// ) {
                        # ignore
                } else {
                        ++$$stats{'postfix:policy:policy-spf:other'};
                        warn __FILE__." $VERSION:".__LINE__." $log:$number unknown: $origline\n";
                }

        return 1;
}
\&register;