GraphDefang

A set of tools to create graphs of your mimedefang or spamd log files.

Written by: John Kirkland

Copyright (c) 2002-2004, John Kirkland

Jump to:

• Description
• Supported Syslog Events
• Examples
• Download
• Required Perl Modules
• Included Files
• Installation Instructions
• FAQ
• License

GraphDefang is a configurable perl utility that parses arbitrary syslog entries and creates a set of configurable charts (png files) with the data. It is possible to output the png files to the filesystem or to a web browser via a cgi.

The following attributes are definable:

• Chart Type (stacked_bar or line)
• Chart Time (hourly, weekly, or monthly)
• X-Axis (Summary, Value1, Value2, Sender, Recipient, Subject, or All)
• Y-Axis (any event pulled out of a syslog file)
• Top Number of Items to Display
• Chart Title
• Filter
• X and Y Graph Sizes
• Graph Filename

Graphdefang will also cache summary data so that it is not necessary to parse and recalculate old data each time new graphs are drawn.

The following syslog events are preconfigured within graphdefang:

• MimeDefang
• SpamAssassin (spamd)
• Sendmail
  • reject (to see any rejected messages from the mail server)
  • user unknown (for dictionary attacks)
• ipop3d
• kernel
  • gshield (firewall log statistics for gshield program)
  • ipchains (firewall log statistics for ipchains)

You can configure your own events by adding configuration files in the event directory.

You can also see the output in action at:

MimeDefang Example:  Live Mimedefang Spam and Virus Stats

Spamd Example:  Live Spamd Spam and Mail Stats

http://www.bl.org/~jpk/graphdefang/download

• File::ReadBackwards
• GD
• GD::Graph
• GD::Text::Align (part of the GDTextUtils package)
• Date::Parse;
• Date::Format;
• MLDBM
• Storable (might already be installed with your perl)

README	README File
ChangeLog	ChangeLog
graphdefanglib.pl	Calculation and graphing routines
graphdefang.pl	Front-end perl script
graphdefang-config-mimedefang-example	Example configuration file for use with mimedefang
graphdefang-config-spamd-example	Example configuration file for use with spamd
web/index.php	Very simple php file to display the resulting png files
web/graphdefang.cgi	CGI that provides a functional web interface for using graphdefang.
event/*	Syslog event configuration files.
TODO
Prioritized list of next things to work on
COPYING	Copy of the GPL

1. Install Required Perl Modules

2. Untar the graphdefang distribution into a directory from where it can run.

3. (for mimedefang only) Add md_log commands per the example mimedefang-filter (included with mimedefang-2.22+).

4. Create a file, graphdefang-config, from the examples included with the distribution. Set $DATAFILE and $OUTPUT_DIR in this file.

5. Copy web/index.php to the $OUTPUT_DIR web directory. Set $OUTPUT_DIR in this file.

6. Copy graphdefang.cgi to the $OUTPUT_DIR web directory. Configure perl cgi access for this directory and set $GRAPHDEFANGDIR in this file.

7. Run graphdefang.pl via cron. I run mine every 15 mins. You can also run adhoc graphdefang queries against the DB by hitting graphdefang.cgi with a web browser.

The Frequently Asked Questions can be seen here.

GraphDefang is released under the GPL license. A copy of the GPL is included in this distribution under the file, COPYING.