Abstract
This is a script which gathers POP3 statistics from a mail log. Then a report is generated which is sent to admin by mail. I wrote this script a long time ago, but maybe somebody will find it useful.
License and Warranty
This program is free software: you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License, or
(at your option) any later version.
This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
GNU General Public License for more details.
You should have received a copy of the GNU General Public License
along with this program. If not, see <http://www.gnu.org/licenses/>.
Requirements
Script is written in PHP. You need a CLI (Command Line Interface) version of PHP not an Apache module. Try executing the following command:
$ php -v
If it executes and prints out your PHP version, then you are OK and you can go ahead. No special requirements for the PHP version AFAK 😉
Install
Install is simple. Unzip, and copy the script into the path of your choice. For example we will deploy it into the /usr/local/bin directory.
$ tar zxvf pop3stat-VER.tgz
$ cp pop3stat /usr/local/bin
$ chmod 755 /usr/local/bin/pop3stat
That’s it – you are done.
Configure
Very simple: edit the script and change the variables at the beginning of the script:
$MAIL_LOG = "/var/log/mail/info"; // Where is your mail log. $MAIL_ADMIN = "admin@yourdomain.com"; // Email addres where we send the report. $MAIL_SUBJECT = "POP3 Stat"; // Subject of the email. $MAIL_FROM = "cron@yourdomain.com"; // This address will appear in "From:".
Cron
To schedule daily reporting, add the following entry into your /etc/crontab:
00 01 * * * root /usr/local/bin/pop3stat.php
The script executes at 01:00 (am) every day. Script processes always data from yesterday, so if fo example executed on March 12 the mail logs from March 11 are only analyzed.
Be careful if you rotate your mail logs – execute pop3stat before mail log rotation.
Log Format
The user can either authenticate using Auth, then the following appears in the log:
Oct 19 04:02:59 yourhost ipop3d[2791]: pop3 service init from X.X.X.X Oct 19 04:02:59 yourhost ipop3d[2791]: Auth user=user02 host=hostname.sk [X.X.X.X] nmsgs=177/177 Oct 19 04:02:59 yourhost ipop3d[2791]: Logout user=user02 host=hostname.sk [X.X.X.X] nmsgs=177 ndele=0
This usually happens when a user connects to POP3 server through webmail. Generic POP3 connection is logged as follows:
Oct 19 04:03:00 yourhost ipop3d[2834]: pop3 service init from Y.Y.Y.Y Oct 19 04:03:00 yourhost ipop3d[2834]: Login user=user03 host=hostname.com [Y.Y.Y.Y] nmsgs=10/10 Oct 19 04:03:00 yourhost ipop3d[2834]: Logout user=user03 host=hostname.com [Y.Y.Y.Y] nmsgs=10 ndele=0
The Report
The actual report looks like this:
Oct, 20 2008
POP3 daemon Statistics
Total POP3d Logins: 8002
Total POP3d Auths: 958
--------
Total POP3d Accs: 8960
Total POP3d Logouts: 8958
POP3 Log Accs ( In Auth) Out Deld Check
============================================
user01: 444 (444 0) 444 6 Ok
user05: 306 (205 101) 306 1 Ok
user14: 20 ( 20 0) 19 0 for 1 time(s) not loged out
user35: 246 (246 0) 246 0 Ok
user62: 246 (246 0) 246 0 Ok
user85: 229 (229 0) 229 7 Ok
...
...
Hourly Statistics: Logins and Auths
One dot = 16 logins
==================================
00 (109): ######
01 (105): ######
02 (83): #####
03 (72): ####
04 (67): ####
05 (71): ####
06 (106): ######
07 (416): ##########################
08 (678): ##########################################
09 (513): ################################
10 (540): #################################
11 (588): ####################################
12 (655): ########################################
13 (787): #################################################
14 (691): ###########################################
15 (667): #########################################
16 (590): ####################################
17 (454): ############################
18 (389): ########################
19 (343): #####################
20 (315): ###################
21 (352): ######################
22 (240): ###############
23 (129): ########
The table has the following fields:
User - name of the mail user Accs - total connections to the POP3 server In - number of logins Auth - number of auths Out - number of logouts Deld - number of mails deleted Check - does Accs = Out? If not, for how many times did not log out the user from the POP3 server.
If you are interested in more details let me know.
Download
The last version is here:
https://zee.balogh.sk/