2,569
edits
Changes
From SME Server
Jump to navigationJump to searchVirus:Email Attachment Blocking (view source)
Revision as of 10:37, 12 June 2009
, 10:37, 12 June 2009→Checking logs for effectiveness of blocking messages with executable content in the attachments
===Checking logs for effectiveness of blocking messages with executable content in the attachments===
===Checking logs===
Checking logs for effectiveness of blocking messages with executable content in the attachments
By reviewing /var/log/qpsmtpd/current and var/log/qpsmtpd/* you can see the entries for rejected messages and generally enough information as to why the rejection occurred, and therefore see the effectiveness of Pattern Matching blocking.
By reviewing /var/log/qpsmtpd/current and var/log/qpsmtpd/* you can see the entries for rejected messages and generally enough information as to why the rejection occurred, and therefore see the effectiveness of Pattern Matching blocking.
You can view date formatted logs using the Server Manager View log files panel
You can view date formatted logs using the Server Manager View log files panel
grep "" /var/log/qpsmtpd/current | tai64nlocal
grep "" /var/log/qpsmtpd/current | tai64nlocal
2004-04-15 15:33:09.021650500 qpsmtp[29265]: 554 We don't accept email with executable content PIF (#5.3.4)
2004-04-15 15:33:09.021650500 qpsmtp[29265]: 554 We don't accept email with executable content PIF (#5.3.4)
Alternatively you could filter on the pattern type code to see how many messages with a particular type of executable content are being rejected eg
Alternatively you could filter on the pattern type code to see how many messages with a particular type of executable content are being rejected eg
2004-04-15 15:33:24.986426500 qpsmtp[29274]: 554 We don't accept email with executable content EXE01 (#5.3.4)
2004-04-15 15:33:24.986426500 qpsmtp[29274]: 554 We don't accept email with executable content EXE01 (#5.3.4)
===Web sites for background information===
===Web sites for background information===
