Antivirus Log or Alert to SysAdmin

This forum contains features that has been archived. This section contains implemented features, duplicate requests, and requests which we have decided not to implement.
Post Reply

Would you like this feature?

Yes
15
94%
No
1
6%
 
Total votes: 16

g0yjs0
Senior user
Senior user
Posts: 282
Joined: 2006-01-26 10:18

Antivirus Log or Alert to SysAdmin

Post by g0yjs0 » 2006-02-06 07:36

I know that hMailServer has the ability to scan emails. What I would like to see would be some type of daily log generated with the attempts of an email account attempting to relay a virus-laden message. If you have an infected user, he's going to send out a bunch of messages before you're aware of it. That means you stand a good chance of getting blacklisted on xbl.spamhaus.org or some other RBL. Keeping a log of SMTP requests (be sure to log SMTP Authentication data) for virus mail would make it easier to track down the infected party so you could disable their account and notify them.

As a further extension to this feature, if a particular user's authentication identity has attempted to relay virus-laden mail over an admin-defined threshhold, then the admin would be notified via email of the situation.

Hope that makes sense.
Dwight Porter

User avatar
TheAngryPenguin
Senior user
Senior user
Posts: 341
Joined: 2004-10-11 20:51

Post by TheAngryPenguin » 2006-02-06 07:43

I think that a Daily Report sent to the postmaster that contained the number of messages processed, for both local and remote delivery, as well as the number of infected messages, etc. would be invaluable.

User avatar
Pern
Normal user
Normal user
Posts: 46
Joined: 2006-09-07 21:14

Post by Pern » 2006-09-08 14:01

sending of a report to an account i think would have to be able to have a root admin and domian admins for this report, posibly with a send to field soit can be sent to lets say a person@yahoo.com account too. an alternate account if you will.
i also would very much like a virus report but id like the name of the virus and any info the virus program can give too... im going to try and make this a script in vb script... i think i can do all of it with a config file...
i also have an idea of lets say server@yourdomian.com would alow for emails to be sent to fire off events like a report, theres alot of logs generated and you can make your own reports too/logs via scripts so maybe ill incorp all of this and try my hand at makeing one as this is something id want...then it does not have to be inside the email server program...its an addon so to speak.
i think im gonna try this
Johnny - aka Pern
WebSite: dragonsworkshop.com ** Happy Holidays**

theTerran
Senior user
Senior user
Posts: 289
Joined: 2004-06-22 18:07
Location: Florida

Post by theTerran » 2006-09-09 03:59

If viruses found are logged in hMailServer logs, this could be just a matter of log mining.
Daniel
Terran Enterprises LLC

g0yjs0
Senior user
Senior user
Posts: 282
Joined: 2006-01-26 10:18

Post by g0yjs0 » 2006-10-20 13:42

FWIW, I'm not so much interested in logging/notification for incoming viruses as much as I am in outgoing viruses, because it's the outgoing ones that will get your server flagged in a RBL/DNSBL. It is precisely for this reason that I would want email notification of this event rather than to wait until I am blacklisted and then have to jump through a bunch of hoops to get delisted. But, I'll take whatever I can get.

Maybe some sort of separate virus log?
Dwight Porter

g0yjs0
Senior user
Senior user
Posts: 282
Joined: 2006-01-26 10:18

Post by g0yjs0 » 2006-11-18 14:57

Well, seeing as how everyone else has bumped their favorite feature request to the top...

^bump^ :D

Post Reply