I'm trying to get blockhosts.py working on my postfix mail log files. Can anyone help? I am NOT good with regex at all. Here is an example line I want to match:
Jul 21 18:42:30 okie1 postfix/smtpd[15919]: NOQUEUE: reject: RCPT from host2.absolute-hosting.net[209.239.36.202]: 550 5.1.1 : Recipient address rejected: User unknown in virtual alias table; from=<> to= proto=ESMTP helo=
Here is the rule I tried to write that doesn't work:
"Postfix": r"""postfix/smtpd\[\d+\].*? NOQUEUE: reject: RCPT from .*? \[(::ffff:)?(?P\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})\],.*? """
ANY HELP WOULD BE APPRECIATED.
Thanks,
-Jon
Travel Travel reports, it is all about food
Montreal: Schwartz's, Le Petit Alep
Albums: Pictures and some notes
ITRANS Song Book Hindi, Urdu, Marathi song lyrics
Online ITRANS Web Interface
BlockHosts block hosts
BlockHosts FAQ
BlockHosts Forum
CD Inserts & Envelopes Web Interface
Nisha Ganatra's Films
Cake: starring Heather Graham
Email: avinash@aczoom.com
Copyright © 1995-2016 Avinash Chopde, avinash@aczoom.com
Postfix reject rule
"Postfix-550": r"""^[^[]+?postfix/smtpd\[\d+\]: NOQUEUE: reject: RCPT from .*?\[(::ffff:)?(?P<host>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})\]: 550 5.1.1 : Recipient address rejected: User unknown in virtual alias table;"""The extra checks for first [ after smptd, and the full text after 550 5.1.1 is useful to help avoid false positives by hackers injecting false lines in the log files. But of course, if postfix program changes that text, then the rule above will need to be updated.