I needed a way to monitor qmail on my Freebsd server. In particular I wanted to shut down qmail if ”too many mails” were sent in a specified timeframe. I previously had a problem when one of my websites began to act as a spam proxy due to a ”bug” in php mail function that enables mail injection. I could not google a solution and had to write my own script.
The approach is fairly simple. The qmail-send log folder ( /var/log/qmail/qmail-send/) contains information about all recently sent emails. My script checks one of these log-files too see if it contains the current date. If it does, then Qmail has sent ”too many” emails and qmail should be shut down. Depending on which log file that is checked and how many records you have in each log file you could determine how many emails that are ”too many” for your qmail server. It is simply a matter of tuning the script by changing ”head -n NUMBER”.
Which action to take when qmail runs wild is up to you. On my server I notify myself by sending a sms to my phone and a simple mail. The script is as follows:
PATH=$PATH:/usr/local/bin
DATE=”`date +%Y-%m-%d`”
LOGFILE=”`ls -lt /var/log/qmail/qmail-send/@* | awk {’print $9’} | head -n 1`”
MAILDATE=”`cat $LOGFILE | tai64nlocal | head -c 10`”
QMAILUP=”`svstat /var/qmail/supervise/qmail-send/ | awk {’print $2’}`”
if [ $QMAILUP == ”down” ]
then
echo No need for checking – Qmail is not running
exit
fi
echo This date: $DATE
echo Log date: $MAILDATE
if [ $DATE == $MAILDATE ]
then
echo Equal dates – Mailing qmail-administrator
/var/qmail/bin/qmail-inject -h < /scripts/smsqmail
echo ”Qmail is stopped” | mailx -s ”Qmail alert” marcus@blahblah.com
echo Shutting down qmail in 20 seconds
sleep 20
qmailctl stop
else
echo Different dates – Everything seems to be okey
fi