# $Id: mailscanner-mrtg.cfg,v 1.23 2004/05/13 18:46:02 kevinspicer Exp $ Workdir: /usr/local/www/mailscanner-mrtg/ IconDir: /mrtg/ WriteExpires: Yes Interval: 5 Refresh: 300 # Defaults Background[_]: #FFFFFF PageTop[$]:
This page will refresh automatically every 5 minutes. WithPeak[_]: wmy XSize[_]: 340 YSize[_]: 100 Options[_]: growright, gauge, nopercent Colours[_]: Blue#7BAEFF,DarkBlue#000099,Green#006500,Violet#ff00ff,Red#990000 Target[mail]: `/usr/local/sbin/mailscanner-mrtg mail` Title[mail]: Mail Relayed Background[mail]: #ffffff PageTop[mail]:

Mail Relayed

This graph represents the total number of messages processed by the system on a daily basis. The thin blue line indicates the number of messages received, the shaded area the number of recipients (one message may have numerous recipients). These figures are logged against mail when it arrives, except for Exim which only logs the number of recipients when mail is sent (message count is still based on incoming though) This graph should be steadily rising through the day. Because it is a constant incremental count, it will only increase or stay the same and NEVER go down. A sharp rise in traffic may be related to a denial of service attack or mass mailing. A flat-line of activity can be indicative of service problems. WithPeak[mail]: wmy Directory[mail]: mail MaxBytes[mail]: 50000 AbsMax[mail]: 1000000 YLegend[mail]: Messages ShortLegend[mail]:  messages     Legend1[mail]: Average Messages (Recipient Count) Legend2[mail]: Average Messages (Message Count) Legend3[mail]: Maximum Messages (Recipient Count) Legend4[mail]: Maximum Messages (Message Count) LegendI[mail]: (count of recipients): Target[mailbytes]: `/usr/local/sbin/mailscanner-mrtg mailbytes` Title[mailbytes]: Bytes of Mail Transferred Background[mailbytes]: #ffffff PageTop[mailbytes]:

Bytes of Mail Transferred

This graph is useful for determining the total network load due to external email. Note that this is bytes of mail on receipt by the incoming MTA process, if you are forwarding processed mail to another server the real network load will be approximately twice this (affected by mail blocked, changes to mail during processing, warnings sent out etc.) Normally this figure is as logged by your MTA, however MSMRTG can be configured to get these figures from MailScanner. Like the Messages Processed graph this should be steadily rising through the day. Because it is a constant incremental count, it will only increase or stay the same and NEVER go down. A sharp rise in traffic may be related to a denial of service attack or mass mailing. A flat-line of activity can be indicative of service problems. WithPeak[mailbytes]: wmy Directory[mailbytes]: mailbytes MaxBytes[mailbytes]: 83886080 AbsMax[mailbytes]: 83886080 YLegend[mailbytes]: Bytes ShortLegend[mailbytes]: bytes     Legend1[mailbytes]: Average Bytes Legend2[mailbytes]: Legend3[mailbytes]: Maximum Bytes Legend4[mailbytes]: LegendI[mailbytes]: : LegendO[mailbytes]: kilo[mailbytes]: 1024 kMG[mailbytes]: k,M,G,T,P Target[spam]: `/usr/local/sbin/mailscanner-mrtg spam` Title[spam]: Spam Identified PageTop[spam]:

Spam Identified

This graph is a count of messages determined to be spam. The shaded area includes all messages blocked by rules in your MTA (such as sendmail access rules, RBLs applied at the MTA etc.) as well as those detected by RBL checks in MailScanner and those with SpamAssassin scores greater than or equal to the Spam Score as defined by MailScanner. This includes High Scoring spam messages. The thin blue line indicates only the messages blocked at the MTA level, therefore the shaded are above the thin blue line can be thought of as the Spam detected by MailScanner and SpamAssassin. This graph can be monitored for extreme deviations but should rise about equally with the Number of Messages Processed graph on an average day. If you use MTA rules to block spam it is possible that this graph may be higher than the number of messages processed. Directory[spam]: spam MaxBytes[spam]: 50000 AbsMax[spam]: 1000000 YLegend[spam]: Messages ShortLegend[spam]: messages     Legend1[spam]: Average Spam Caught (total) Legend2[spam]: Average Spam Caught by MTA Rules Legend3[spam]: Maximum Spam Caught (total) Legend4[spam]: Maximum Spam Caught by MTA Rules LegendI[spam]:  Spam Caught (total): LegendO[spam]:  Spam Blocked by MTA Rules: Target[loadavg]: `/usr/local/sbin/mailscanner-mrtg loadavg` Title[loadavg]: Machine Load Average PageTop[loadavg]:

Machine Load Average

NB The Y axis shows load x 100!
This graph is used for system health monitoring. It is best to compare this graph to an established baseline, as reasonably high load averages do not necessarily indicate a performance problem. Load averages should be considered in relation to CPU Utilization, network and disk I/O (sorry theres no graph for disk I/O, use the iostat program if it is available on your system). In particular there may be many processes waiting on network I/O (such as MTA processes sending and receiving, MailScanner and SpamAssassin performing RBL checks etc.), whilst these do increase the load average they are not necessarily affecting the ability of your system to process mail. Directory[loadavg]: loadavg MaxBytes[loadavg]: 10000 AbsMax[loadavg]: 10000 YLegend[loadavg]: Load x 100 ShortLegend[loadavg]:     Legend1[loadavg]: Average Load Legend2[loadavg]: Legend3[loadavg]: Maximum Load Legend4[loadavg]: LegendI[loadavg]:  Load: LegendO[loadavg]: Factor[loadavg]: 0.01 # sendmail here means mta - we don't change it though as we don't want to mess # up anyones historic data Target[sendmail]: `/usr/local/sbin/mailscanner-mrtg mta` Title[sendmail]: MTA processes Running PageTop[sendmail]:

MTA Processes Running

This graph is an indicator of the environment health. It is not uncommon to see MTA processes reach into the hundreds during busy periods. Each message being delivered may spawn an additional MTA process. Copies of MTA will usually show large spikes during periods of high activity. Directory[sendmail]: sendmail MaxBytes[sendmail]: 200 AbsMax[sendmail]: 1000 YLegend[sendmail]: Copies Running ShortLegend[sendmail]:     Legend1[sendmail]: Average Copies Legend2[sendmail]: Legend3[sendmail]: Maximum Copies Legend4[sendmail]: LegendI[sendmail]:  Copies: LegendO[sendmail]: Target[mailscanner]: `/usr/local/sbin/mailscanner-mrtg mailscanner` Title[mailscanner]: Copies Of MailScanner Running PageTop[mailscanner]:

Copies Of MailScanner Running

This graph is an indicator of the environment health. When the system is mostly idle the number of MailScanner processes should be the number of children configured in MailScanner.conf plus a single parent process. When MailScanner is processing messages it often forks children (grandchildren of the single parent process) to handle certain tasks, therefore it is not a cause for concern if at busy times there are as many as double the number of processes seen when the system is idle. Directory[mailscanner]: mailscanner MaxBytes[mailscanner]: 25 AbsMax[mailscanner]: 100 YLegend[mailscanner]: Copies Running ShortLegend[mailscanner]:     Legend1[mailscanner]: Average Copies Legend2[mailscanner]: Legend3[mailscanner]: Maximum Copies Legend4[mailscanner]: LegendI[mailscanner]:  Copies: LegendO[mailscanner]: Target[outqueue]: `/usr/local/sbin/mailscanner-mrtg outqueue` Title[outqueue]: Number Of Files In Outgoing Queue PageTop[outqueue]:

Number Of Files In Outgoing Queue

This graph provides an indication of the incoming queue status. If there is a steadily rising number of messages there is most likely a problem transferring mail. MailScanner may be down or experiencing problems processing mail. Any rapid increase in either of these queues is worthy of investigation. Note that some MTAs use multiple files for each mail (for example sendmail uses 2 files for each mail) Directory[outqueue]: outqueue MaxBytes[outqueue]: 2000 AbsMax[outqueue]: 1000000 YLegend[outqueue]: Files ShortLegend[outqueue]:  Files     Legend1[outqueue]: Average Files Legend2[outqueue]: Legend3[outqueue]: Maximum Files Legend4[outqueue]: LegendI[outqueue]: : LegendO[outqueue]: Target[inqueue]: `/usr/local/sbin/mailscanner-mrtg inqueue` Title[inqueue]: Number Of Files In Incoming Queue PageTop[inqueue]:

Number Of Files In Incoming Queue

This graph provides an indication of the outgoing queue status. If there is a steadily rising number of messages in this queue there is most likely a problem transferring mail. The problem is most likely related to the mail server (smtp service may be down). DNS problems are also a probable cause of outbound queue buildup. Any rapid increase in either of these queues is worthy of investigation. Note that some MTAs use multiple files for each mail (for example sendmail uses 2 files for each mail) Directory[inqueue]: inqueue MaxBytes[inqueue]: 20 AbsMax[inqueue]: 1000000 YLegend[inqueue]: Files ShortLegend[inqueue]:  Files     Legend1[inqueue]: Average Files Legend2[inqueue]: Legend3[inqueue]: Maximum Files Legend4[inqueue]: LegendI[inqueue]: : LegendO[inqueue]: Target[quarantine]: `/usr/local/sbin/mailscanner-mrtg quarantine` Title[quarantine]: Number Of Files / Messages In Quarantine PageTop[quarantine]:

Number Of Files / Messages In Quarantine

This graph provides an indication of the quarantine status. It is strongly recommended to enable the clean.quarantine script provided by MailScanner to keep this directory manageable. The shaded area shows the number of files, the thin blue line shows the number of messages. Directory[quarantine]: quarantine MaxBytes[quarantine]: 20 AbsMax[quarantine]: 1000000 YLegend[quarantine]: Files ShortLegend[quarantine]:       Legend1[quarantine]: Average Files Legend2[quarantine]: Average Messages Legend3[quarantine]: Maximum Files Legend4[quarantine]: Maximum Messages LegendI[quarantine]: Files: LegendO[quarantine]: Messages: Target[memory]: `/usr/local/sbin/mailscanner-mrtg memory` Title[memory]: Ram Usage PageTop[memory]:

Ram Usage

This graph is used for system health monitoring. The shaded area represents the total amount of RAM used including that used for filesystem caching to improve performance. On most modern operating systems this figure will be approximately the same as your total amount of physical memory once the machine has been running for a while. Memory used for filesystem cache is recovered if needed by a running process. The thin blue line represents the memory usage without including the cache. Running out of memory causes the machine to start swapping to disk, this can very quickly slow your machine to a crawl. Directory[memory]: memory MaxBytes[memory]: 1500 AbsMax[memory]: 1000000 YLegend[memory]: RAM used ShortLegend[memory]:  RAM Used     Legend1[memory]: Average RAM Used Including Cache Legend2[memory]: Average RAM Used Excluding Cache Legend3[memory]: Maximum RAM Used Including Cache Legend4[memory]: Maximum RAM Used Excluding Cache LegendI[memory]:  RAM used including cache: LegendO[memory]:  RAM used excluding cache: # I don't know anyone with Petabytes of RAM, but what the hell # call it future proofing! kMG[memory]: M,G,T,P kilo[memory]: 1024 Target[virus]: `/usr/local/sbin/mailscanner-mrtg virus` Title[virus]: Mail Containing a Virus or Failing Content Checks PageTop[virus]:

Mail Containing a Virus or Failing Content Checks

This graph shows a total number of messages found that violate content filtering rules. The shaded area represents messages blocked, quarantined, cleaned or disinfected because of viruses, forbidden extensions or filetypes and html embedded malicious code. The thin blue line shows only those of the above detected by virus scanners. Please note that some messages may trigger multiple content rules and/or contain multiple viruses, in this event these messages may cause this graph to appear higher than it should be. Any sharp rise in this graph may be worthy of investigation. Directory[virus]: virus MaxBytes[virus]: 50000 AbsMax[virus]: 1000000 YLegend[virus]: Viruses/Problems ShortLegend[virus]:     Legend1[virus]: Average Infected Mail Legend2[virus]: Average Viruses Detected Legend3[virus]: Maximum Infected Mail Legend4[virus]: Maximum Viruses Detected LegendI[virus]:  Infected Mail   LegendO[virus]:  Viruses Detected   Target[cpu]: `/usr/local/sbin/mailscanner-mrtg cpu` Title[cpu]: CPU Utilization Percentage PageTop[cpu]:

CPU Utilization Percentage

This graph is used for system health monitoring. The shaded area represents the total CPU utilization, the thin blue line the CPU utilization by user processes. Note that CPU utilization is an average for all processors on the system. Directory[cpu]: cpu MaxBytes[cpu]: 100 Unscaled[cpu]: dwmy YLegend[cpu]: Percentage ShortLegend[cpu]: percent     Legend1[cpu]: Average CPU (total) Legend2[cpu]: Average CPU (user) Legend3[cpu]: Maximum CPU (total) Legend4[cpu]: Maximum CPU (user) LegendI[cpu]:  CPU Utilization (total): LegendO[cpu]:  CPU Utilization (user): Target[spoolusage]: `/usr/local/sbin/mailscanner-mrtg spoolusage` Title[spoolusage]: Disk Space Used in Spool Filesystem PageTop[spoolusage]:

Disk Space Used in Spool Filesystem

This graph shows the percentage of space used in the filesystem that houses the mail spool. NOTE: You must set this in the configuration file to be a mounted filesystem (as shown by the df command). In some configurations this may be the same filesystem as the Work Directory or even the root filesystem, in which case these graphs will be identical. Directory[spoolusage]: spoolusage MaxBytes[spoolusage]: 100 Unscaled[spoolusage]: dwmy YLegend[spoolusage]: Percentage ShortLegend[spoolusage]: percent     Legend1[spoolusage]: Average Used Legend2[spoolusage]: Legend3[spoolusage]: Maximum Used Legend4[spoolusage]: LegendI[spoolusage]:  Space Used: LegendO[spoolusage]: Target[tmpfsusage]: `/usr/local/sbin/mailscanner-mrtg tmpfsusage` Title[tmpfsusage]: Disk Space Used in Work Filesystem. PageTop[tmpfsusage]:

Disk Space Used in Work Filesystem.

This graph shows the percentage of space used in the filesystem used by MailScanner for working space. NOTE: You must set this in the configuration file to be a mounted filesystem (as shown by the df command). This graph is mainly included for those sites that put the work directory in a ramdisk or tmpfs for performance reasons. In some configurations this may be the same filesystem as the Work Directory or even the root filesystem, in which case these graphs will be identical. Directory[tmpfsusage]: tmpfsusage MaxBytes[tmpfsusage]: 100 Unscaled[tmpfsusage]: dwmy YLegend[tmpfsusage]: Percentage ShortLegend[tmpfsusage]: percent     Legend1[tmpfsusage]: Average Used Legend2[tmpfsusage]: Legend3[tmpfsusage]: Maximum Used Legend4[tmpfsusage]: LegendI[tmpfsusage]:  Space Used: LegendO[tmpfsusage]: Target[rootusage]: `/usr/local/sbin/mailscanner-mrtg rootusage` Title[rootusage]: Disk Space Used in / PageTop[rootusage]:

Disk Space Used in /

This graph shows the percentage of space used in the root filesystem. In some configurations this may be the same filesystem as the Work Directory or even the root filesystem, in which case these graphs will be identical. Directory[rootusage]: rootusage XSize[rootusage]: 340 YSize[rootusage]: 100 MaxBytes[rootusage]: 100 Unscaled[rootusage]: dwmy YLegend[rootusage]: Percentage ShortLegend[rootusage]: percent     Legend1[rootusage]: Average Used Legend2[rootusage]: Legend3[rootusage]: Maximum Used Legend4[rootusage]: LegendI[rootusage]:  Space Used: LegendO[rootusage]: Target[iptrafficnew]: `/usr/local/sbin/mailscanner-mrtg iptraffic` MaxBytes[iptrafficnew]: 1250000000 Directory[iptrafficnew]: iptrafficnew Title[iptrafficnew]: Server Network Traffic PageTop[iptrafficnew]:

Server Network Traffic

This graph shows the total network traffic for all network interfaces (or rather all network interfaces configured in the MSMRTG configuration file). The shaded area shows incoming traffic, and the thin blue line the outgoing traffic. YLegend[iptrafficnew]: Bits per second ShortLegend[iptrafficnew]: b/s Legend1[iptrafficnew]: Incoming Traffic (5 minute average) Legend2[iptrafficnew]: Outgoing Traffic (5 minute average) Legend3[iptrafficnew]: Maximum Incoming Traffic (5 minute average) Legend4[iptrafficnew]: Maximal Outgoing Traffic (5 minute average) LegendI[iptrafficnew]:  In: LegendO[iptrafficnew]:  Out: Target[spamratio]: `/usr/local/sbin/mailscanner-mrtg spamratio` Title[spamratio]: Spam as Percentage of Total Mail PageTop[spamratio]:

Spam as Percentage of Total Mail

This graph shows the percentage of mail submitted that is recognised as spam. The shaded area shows all spam detections, the thin blue line is just that spam blocked by MTA rules. NOTE: this graph show the percentage of mail submitted rather than the percentage of mail processed. The difference is that submitted mail includes messages rejected by the MTA (and so not actually processed by MailScanner). The default is to show the average for each 5 minute period, but you can configure this to show a running average for each 24 hours instead. Directory[spamratio]: spamratio MaxBytes[spamratio]: 100 Unscaled[spamratio]: dwmy YLegend[spamratio]: Percentage ShortLegend[spamratio]: percent     Legend1[spamratio]: Average Spam (total) Legend2[spamratio]: Average Spam (detected by MTA) Legend3[spamratio]: Maximum Spam (total) Legend4[spamratio]: Maximum Spam (blocked by MTA) LegendI[spamratio]:  Spam (total): LegendO[spamratio]:  Spam (blocked by MTA): Target[virusratio]: `/usr/local/sbin/mailscanner-mrtg virusratio` Title[virusratio]: Viruses and Blocked Content as Percentage of Total Mail PageTop[virusratio]:

Viruses and Blocked Content as Percentage of Total Mail

This graph shows the percentage of processed mail which triggers content checks or contains a virus. The shaded area is content checks and viruses combined, the thin blue line is viruses only. The default is to show the average for each 5 minute period, but you can configure this to show a running average for each 24 hours instead. Directory[virusratio]: virusratio MaxBytes[virusratio]: 100 Unscaled[virusratio]: dwmy YLegend[virusratio]: Percentage ShortLegend[virusratio]: percent     Legend1[virusratio]: Average Blocked Content Legend2[virusratio]: Average Viruses Legend3[virusratio]: Maximum Blocked Content Legend4[virusratio]: Maximum Viruses LegendI[virusratio]:  Blocked Content: LegendO[virusratio]:  Viruses: Target[batchsize]: `/usr/local/sbin/mailscanner-mrtg batchsize` Title[batchsize]: Average Number of Messages Per Batch PageTop[batchsize]:

Average Number of Messages Per Batch

This graph show the average number of messages per batch processed, it is useful to assist in understanding the Processing Speed graph (since processing speed will decrease as batch size increases). Directory[batchsize]: batchsize MaxBytes[batchsize]: 500 YLegend[batchsize]: Messages ShortLegend[batchsize]: messages     Legend1[batchsize]: Average Batch Size Legend2[batchsize]: Legend3[batchsize]: Maximum Batch Size Legend4[batchsize]: LegendI[batchsize]:  Batch Size: LegendO[batchsize]: : Target[speed]: `/usr/local/sbin/mailscanner-mrtg speed` Title[speed]: Processing Speed PageTop[speed]:

Processing Speed

This graph show the average speed of processing by MailScanner (this is the time from MailScanner collecting a message from the incoming queue to dropping it into the outgoing queue for delivery). in order for this graph to work you must set Log Speed = yes in MailScanner.conf. NOTE: Unlike most other graphs a low reading here suggests a problem (i.e. slow speed or processing) The shaded area represents the average speed for the entire process, the dark blue line show the speed of spam checks (as these most often cause delays) Directory[speed]: speed MaxBytes[speed]: 10000000 YLegend[speed]: Bytes per second ShortLegend[speed]: B/s     Legend1[speed]: Average Total Processing Speed Legend2[speed]: Average Spam Checks Speed Legend3[speed]: Maximum Total Processing Speed Legend4[speed]: Maximum Spam Checks Speed LegendI[speed]:  Total Processing Speed: LegendO[speed]:  Spam Checks Speed: