Abstract

This is a script which gathers POP3 statistics from a mail log. Then a report is generated which is sent to admin by mail. I wrote this script a long time ago, but maybe somebody will find it useful.

License and Warranty

    This program is free software: you can redistribute it and/or modify
    it under the terms of the GNU General Public License as published by
    the Free Software Foundation, either version 3 of the License, or
    (at your option) any later version.

    This program is distributed in the hope that it will be useful,
    but WITHOUT ANY WARRANTY; without even the implied warranty of
    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
    GNU General Public License for more details.

    You should have received a copy of the GNU General Public License
    along with this program.  If not, see <http://www.gnu.org/licenses/>.

Requirements

Script is written in PHP. You need a CLI (Command Line Interface) version of PHP not an Apache module. Try executing the following command:

$ php -v

If it executes and prints out your PHP version, then you are OK and you can go ahead. No special requirements for the PHP version AFAK ūüėČ

Install

Install is simple. Unzip, and copy the script into the path of your choice. For example we will deploy it into the /usr/local/bin directory.

$ tar zxvf pop3stat-VER.tgz
$ cp pop3stat /usr/local/bin
$ chmod 755 /usr/local/bin/pop3stat

That’s it – you are done.

Configure

Very simple: edit the script and change the  variables at the beginning of the script:

$MAIL_LOG     = "/var/log/mail/info";   // Where is your mail log.
$MAIL_ADMIN   = "admin@yourdomain.com"; // Email addres where we send the report.
$MAIL_SUBJECT = "POP3 Stat";            // Subject of the email.
$MAIL_FROM    = "cron@yourdomain.com";  // This address will appear in "From:".

Cron

To schedule daily reporting, add the following entry into your /etc/crontab:

00 01 * * * root /usr/local/bin/pop3stat.php

The script executes at 01:00 (am) every day. Script processes always data from yesterday, so if fo example executed on March 12 the mail logs from March 11 are only analyzed.

Be careful if you rotate your mail logs – execute pop3stat before mail log rotation.

Log Format

The user can either authenticate using Auth, then the following appears in the log:

Oct 19 04:02:59 yourhost ipop3d[2791]: pop3 service init from X.X.X.X
Oct 19 04:02:59 yourhost ipop3d[2791]: Auth user=user02 host=hostname.sk [X.X.X.X] nmsgs=177/177
Oct 19 04:02:59 yourhost ipop3d[2791]: Logout user=user02 host=hostname.sk [X.X.X.X] nmsgs=177 ndele=0

This usually happens when a user connects to POP3 server through webmail. Generic POP3 connection is logged as follows:

Oct 19 04:03:00 yourhost ipop3d[2834]: pop3 service init from Y.Y.Y.Y
Oct 19 04:03:00 yourhost ipop3d[2834]: Login user=user03 host=hostname.com [Y.Y.Y.Y] nmsgs=10/10
Oct 19 04:03:00 yourhost ipop3d[2834]: Logout user=user03 host=hostname.com [Y.Y.Y.Y] nmsgs=10 ndele=0

The Report

The actual report looks like this:

Oct, 20 2008

POP3 daemon Statistics

Total POP3d Logins:     8002
Total POP3d Auths:       958
                    --------
Total POP3d Accs:       8960
Total POP3d Logouts:    8958

POP3 Log   Accs  ( In Auth)  Out Deld  Check
============================================
user01:     444  (444    0)  444    6  Ok
user05:     306  (205  101)  306    1  Ok
user14:      20  ( 20    0)   19    0  for 1 time(s) not loged out
user35:     246  (246    0)  246    0  Ok
user62:     246  (246    0)  246    0  Ok
user85:     229  (229    0)  229    7  Ok
...
...

Hourly Statistics: Logins and Auths
One dot = 16 logins
==================================
00 (109): ######
01 (105): ######
02  (83): #####
03  (72): ####
04  (67): ####
05  (71): ####
06 (106): ######
07 (416): ##########################
08 (678): ##########################################
09 (513): ################################
10 (540): #################################
11 (588): ####################################
12 (655): ########################################
13 (787): #################################################
14 (691): ###########################################
15 (667): #########################################
16 (590): ####################################
17 (454): ############################
18 (389): ########################
19 (343): #####################
20 (315): ###################
21 (352): ######################
22 (240): ###############
23 (129): ########

The table has the following fields:

User - name of the mail user
Accs - total connections to the POP3 server
In - number of logins
Auth - number of auths
Out - number of logouts
Deld - number of mails deleted
Check - does Accs = Out? If not, for how many times did not log out the user from the POP3 server.

If you are interested in more details let me know.

Download

The last version is here:

https://zee.balogh.sk/

Leave a Reply

Your email address will not be published. Required fields are marked *