##########################################################################

# $Id$

##########################################################################

########################################################

# Originally written by:

#    Dariusz Nierada <dnierada@kat.supermedia.pl>

########################################################

# Please send all comments, suggestions, bug reports,

#    etc, to logwatch-devel@lists.sourceforge.net

########################################################

########################################################

# Default Detail Levels:

#     0: Prints MisFormatted log lines (should never happen)

#        Virus/Malware blocks (if AntiVirus configured)

#        Prints protocol violations (by category)

#        Prints address verification rejections

#        Prints administrative rejections (by category)

#        Prints Refused Relay count

#

#     5: Prints Queue Run count

#        Prints server Stop/Start

#

#    10: Prints Refused Relay (individual lines)

#        Prints Per Message Tracking

########################################################

########################################################

## Copyright (c) 2008 Gary Allen Vollink

## Covered under the included MIT/X-Consortium License:

##    http://www.opensource.org/licenses/mit-license.php

## All modifications and contributions by other persons to

## this script are assumed to have been donated to the

## Logwatch project and thus assume the above copyright

## and licensing terms.  If you want to make contributions

## under your own copyright or a different license this

## must be explicitly stated in the contribution an the

## Logwatch project reserves the right to not accept such

## contributions.  If you have made significant

## contributions to this script and want to claim

## copyright please contact logwatch-devel@lists.sourceforge.net.

#########################################################

use Logwatch ':dates';

use warnings;

$Detail       = $ENV{'LOGWATCH_DETAIL_LEVEL'}  || 0;

$LvlBadFormat    = $ENV{'exim_misformat'}     || 0;

$LvlRestarts     = $ENV{'exim_restart'}       || 5;

$LvlVirus        = $ENV{'exim_virus'}         || 0;

$LvlProtocl      = $ENV{'exim_protocol'}      || 0;

$LvlProtoclLines = $ENV{'exim_protocol_lines'}|| 5;

$LvlDontAccept   = $ENV{'exim_dontaccept'}    || 0;

$LvlDontAcceptLines = $ENV{'exim_dontaccept_lines'}    || 0;

$LvlVerify       = $ENV{'exim_verify'}        || 0;

$LvlVerifyLines  = $ENV{'exim_verify_lines'}  || 5;

$LvlRuns         = $ENV{'exim_runs'}          || 5;

$LvlRelay        = $ENV{'exim_relay'}         || 0;

$LvlRelayLines   = $ENV{'exim_relay_lines'}   || 10;

$LvlMsgs         = $ENV{'exim_mesgs'}         || 10;

# procedura sortujaca tak jak ja chce (bo tamta sotrowala po ASCII)

# procedure to compare numbers at the beginning of submitted strings.

#  .. Which in this case is the message count for a given message ID.

sub wedlug_liczb {

    ($aa) = ($a =~ /^(\d+).+/);

    ($bb) = ($b =~ /^(\d+).+/);

    $aa <=> $bb;

}

# START

my $SearchDate = TimeFilter("%Y-%m-%d %H:%M:%S");

$StartQueue = 0;

$EndQueue = 0;

# Regex to match IPv4 addresses and IPv6 addresses

# IPv6 part could be made more strict

my $IPAddress = qr/\d+\.\d+\.\d+\.\d+|[a-fA-F0-9]*:[a-fA-F0-9:]+/;

while (defined($ThisLine = <STDIN>)) {

   chomp($ThisLine);

    # pobierz dzisiejsza date z 2002-03-31 22:13:48 ...

    # Collect this line's date, e.g. 2002-03-31 22:13:48 ...

   do {

      $BadFormat{$ThisLine}++;

      next;

   } unless ($year1,$month1,$day1,$h1,$m1,$s1) = ($ThisLine =~ /^(\d+)\-(\d+)\-(\d+)\s(\d+):(\d+):(\d+)\s.+/);

   next unless $ThisLine =~ /^$SearchDate /o;

   if ( $ThisLine =~ /End queue run\:/ ) {

      $EndQueue++;

   }

   elsif ( $ThisLine =~ /Start queue run\:/ ) {

      $StartQueue++;

   }

   elsif ( $ThisLine =~ /sender verify defer/ ) {

      # ignore this; it's temporary

   }

   elsif ( $ThisLine =~ /unknown variable name/ ) {

      # ignore this temporarily

   }

   elsif ( $ThisLine =~ /ignoring AUTH=.*? \(client not authenticated\)/ ) {

      # ignore this; it is a warning.

   }

   elsif ( $ThisLine =~ /cwd=.*? \d args: / ) {

      # ignore this; it is exim (or an Exim sub-command) starting.

   }

   elsif ( $ThisLine =~ /[Rr]ecipient verify fail/ ) {

      $RecipVerify{$ThisLine}++;

   }

   elsif ( $ThisLine =~ /[Ss]ender verify fail/ ) {

      $SendVerify{$ThisLine}++;

   }

   elsif ( $ThisLine =~ /fragments administratively prohib/ ) {

      $DontAccept{$ThisLine}++;

   }

   elsif ( $ThisLine =~ /unqualified (sender|recipient) rejected/ ) {

      $DontAccept{$ThisLine}++;

   }

   elsif ( $ThisLine =~ /do not accept mail / ) {

      $DontAccept{$ThisLine}++;

   }

   elsif ( $ThisLine =~ /rejected connection in .connect. ACL/ ) {

      # Likely policy rejections

      $DontAccept{$ThisLine}++;

   }

   elsif ( $ThisLine =~ /believed to be spam/ ) {

      $DontAccept{$ThisLine}++;

   }

   elsif ( $ThisLine =~ /[Ww]arning: dnsbl\.sorbs\.net/ ) {

      $DontAccept{$ThisLine}++;

   }

   elsif ( $ThisLine =~ /mail not permitted from/ ) {

      $DontAccept{$ThisLine}++;

   }

   elsif ( $ThisLine =~ /file, which is blacklisted/ ) {

      $DontAccept{$ThisLine}++;

   }

   elsif ( $ThisLine =~ /not accept Windows executables/ ) {

      $DontAccept{$ThisLine}++;

   }

   elsif ( $ThisLine =~ /remote host address is the local host/ ) {

      $DontAccept{$ThisLine}++;

   }

   elsif ( $ThisLine =~ /message contains malware/ ) {

      # Exim <= 4.44 with ExiScan-ACL Patch (Running AntiVirus Software)

      $Virus{$ThisLine}++;

   }

   elsif ( $ThisLine =~ /message contains a [vV]irus/ ) {

      # Exim >= 4.50 compiled with WITH_CONTENT_SCAN=yes (Running AntiVirus Software)

      $Virus{$ThisLine}++;

   }

   elsif ( $ThisLine =~ /SMTP connection from/ ) {

      # Common error from SPAM hosts.

      $Proto{$ThisLine}++;

   }

   elsif ( $ThisLine =~ /SMTP syntax error in/ ) {

      # Common error from SPAM hosts.

      $Proto{$ThisLine}++;

   }

   elsif ( $ThisLine =~ /remote host used my name in HELO/ ) {

      # Common error from SPAM hosts.

      $Proto{$ThisLine}++;

   }

   elsif ( $ThisLine =~ /remote host used IP address in HELO/ ) {

      # Common error from SPAM hosts.

      $Proto{$ThisLine}++;

   }

   elsif ( $ThisLine =~ /unexpected disconnection while reading SMTP command/ ) {

      # Common error from SPAM hosts.

      $Proto{$ThisLine}++;

   }

   elsif ( $ThisLine =~ /SMTP protocol violation/ ) {

      # Common error from SPAM hosts.

      $Proto{$ThisLine}++;

   }

   elsif ( $ThisLine =~ /SMTP command timeout/ ) {

      # Common error from SPAM hosts.

      $Proto{$ThisLine}++;

   }

   elsif ( $ThisLine =~ /SMTP data timeout/ ) {

      # Common error from SPAM hosts.

      $Proto{$ThisLine}++;

   }

   elsif ( $ThisLine =~ /incomplete transaction \(([\s\w]+)\) from/ ) {

      # Common error from SPAM hosts (after recipient reject/callout).

      $Proto{$ThisLine}++;

   }

   elsif ( $ThisLine =~ /SMTP protocol synchronization error \(([\s\w:]+)\):/ ) {

      # Spammer who does not wait before sending crap

      $Proto{$ThisLine}++;

   }

   elsif ( $ThisLine =~ /dropped: too many nonmail commands/ ) {

      # Often someone who tries lots of transactions

      $Proto{$ThisLine}++;

   }

   elsif ( $ThisLine =~ /dropped: too many syntax or protocol errors/ ) {

      # Often someone who tries lots of transactions

      $Proto{$ThisLine}++;

   }

   elsif ( $ThisLine =~ /SMTP protocol error in \"\w+\"/ ) {

      # Some hosts ask for TLS even when not offered (generalised to all cmds)

      $Proto{$ThisLine}++;

   }

   elsif ( $ThisLine =~ /Connection from .* too many connections from that IP address/ ) {

      # Some hosts make lots of simultaneous connections

	  # this is an extra error message when logging is high

	  # and since another message duplicates it, we can just ignore this

   }

   elsif ( $ThisLine =~ /rejected [HE][EH]LO from\s/ ) {

      # Typically due to underscores _ in the HELO line

      #   (a common protocol violation)

      # Also can be due to odd escape sequences

      #   (never seen from a valid MX)

      $Proto{$ThisLine}++;

   }

   elsif ( $ThisLine =~ /SIGHUP received\: re-exec/ ) {

      push @Restart, "$year1-$month1-$day1 $h1:$m1:$s1 (stop)";

   }

   elsif ( $ThisLine =~ /daemon started\:/ ) {

      push @Restart, "$year1-$month1-$day1 $h1:$m1:$s1 (start)";

   }

   elsif ( $ThisLine =~ /rejected RCPT.*greylist/) {

      $Greylist++;

      push @GreylistH, $ThisLine;

   }

   elsif ( $ThisLine =~ /refused relay/ || $ThisLine =~ /rejected RCPT/ ) {

      $Relay++;

      push @RelayH, $ThisLine;

   }

   elsif ( $ThisLine =~ /no host name found for IP address/ ) {

      $ReverseLookup++;

      push @ReverseLookupH, $ThisLine;

   }

   elsif ( $ThisLine =~ /no IP address found for host/ ) {

      $Lookup++;

      push @LookupH, $ThisLine;

   }

   elsif ( $ThisLine =~ /DKIM: .* \[verification succeeded\]/ ) {

      # Ignore successful DKIM verification reports

      # http://www.exim.org/exim-html-current/doc/html/spec_html/ch-support_for_dkim_domainkeys_identified_mail.html

   }

   elsif ( $ThisLine =~ /^\d+\-\d+\-\d+\s\d+\:\d+\:\d+\s(\+\d+\s)?\w+\-\w+\-\w+\s/ ) { # inne wiadomosci przesylane przez EXIMA

    # Collect Message ID specific notes...

    ($mdate,$mtime,$mid,$mrest) = ($ThisLine =~ /^(\d+\-\d+\-\d+)\s(\d+\:\d+\:\d+)\s(?:\+\d+\s)?(\w+\-\w+\-\w+)(.+)/);

      # Count of individual Message Lines, used for sort

    $licze++;         # Dodaje taki licznik aby potem przy wypisaniu posortowac po nim, bo wypisywal nie po kolei

    $mmsg{$mid}{$licze.$mrest} = "$mdate $mtime";

   }

   else

   {

      $OtherList{$ThisLine}++;

   }

} #end while

# Print MisFormatted log lines (should never happen)

if ($Detail >= $LvlBadFormat) {

   if (%BadFormat) {

      print "\n***** BAD FORMAT (Possible data corruption or Exim bug) *****\n";

      foreach $ThisOne (keys %BadFormat) {

         print "$ThisOne\n";

      }

   }

}

# Print server Stops/Starts

if ($Detail >= $LvlRestarts) {

   if (@Restart) {

      print "\n--- Exim Restarted ---\n";

      foreach $ThisOne (sort @Restart) {

         print "  $ThisOne\n";

      }

   }

}

if ($Detail >= $LvlRuns) {

   if (($StartQueue >0 ) or ($EndQueue > 0)) {

      print "\n--- Queue Runners ---\n";

      # Start Queue

      $StartQueue and print "  Start queue run: $StartQueue Time(s)\n";

      # End Queue

      $EndQueue and print "  End queue run: $EndQueue Time(s)\n";

   }

}

if ($Detail >= $LvlVerify) {

   if ((@SendVerify) and (@RecipVerify)) {

      print "\n--- Address Verification ---\n";

   }

   if (@SendVerify) {

      # Sender Verifies

      $SendVerify and print "\nSender Verify failures: $SendVerify Time(s)\n";

      if ($Detail >= $LvlVerifyLines) {

         foreach $ThisOne (@SendVerify) {

            print "  $ThisOne\n";

         }

      }

   }

   if (@RecipVerify) {

      # Recip Verifies

      $RecipVerify and print "Recipient Verify failures: $RecipVerify Time(s)\n";

      if ($Detail >= $LvlVerifyLines) {

         foreach $ThisOne (@RecipVerify) {

            print "  $ThisOne\n";

         }

      }

   }

}

if ($Detail >= $LvlRelay) {

   if (@GreylistH) {

      print "\n--- Greylisted $Greylist times\n";

      if ( $Detail >= $LvlRelayLines ) {

         print   "--- Lines follow:\n\n";

         foreach $ThisOne (@GreylistH) {

            print "$ThisOne\n";

         }

      }

   }

   if (@RelayH) {

      print "\n--- Refused Relays $Relay times\n";

      if ( $Detail >= $LvlRelayLines ) {

         print   "--- Lines follow:\n\n";

         foreach $ThisOne (@RelayH) {

            print "$ThisOne\n";

         }

      }

   }

}

if ($Detail >= $LvlVirus) {

   # Print Blocked Viruses/Malware

   if (%Virus) {

      my (%vir);

      print "\n--- Virus/Malware Blocked ---\n";

      foreach $ThisOne (sort(keys %Virus)) {

         # Need mid empty...

         $mid = "";

         # Virus name holder...

         $cc = "";

         # Extract exim date and time string...

         ($mdate, $mtime) = ($ThisOne =~ m/^(\d+-\d+-\d+)\s(\d+\:\d+\:\d+)\s/);

         # Link date and time (looks cleaner)...

         $aa = "$mdate $mtime";

         # Extract the REAL IP address...

         ($bb) = ($ThisOne =~ m/\s\[($IPAddress)\]\s/);

            # Exim >= 4.50 compiled with, WITH_CONTENT_SCAN=yes

         # Default warning looks like this...

            # rejected after DATA: This message contains a [vV]irus (%s).

         if ($ThisOne =~ m/virus \((.*?)\)/) {

            $cc = $1;

         }

            # Exim <= 4.44 with ExiScan-ACL patch

            # rejected after DATA: This message contains malware (%s)

         elsif ($ThisOne =~ m/malware \((.*?)\)/) {

            $cc = $1;

         }

         # There is probably a more graceful way to do this...

         if (defined( $vir{$cc} )) {

            # Assign current value to temporary (mid)

            $mid = $vir{$cc};

         }

         # Set current value to (old value)+new value+','

         $vir{$cc} = "$mid$aa : IP:$bb,";

      }

      # Print the results...

      foreach $ThisOne (sort(keys %vir)) {

         print "Virus: [$ThisOne]\n";

         foreach $aa ( sort( split /,/, $vir{$ThisOne} )) {

            print "   $aa\n";

         }

      }

   }

}

if ($Detail >= $LvlDontAccept) {

   # Print Administrative Prohibitions

   if (%DontAccept) {

      my (%spam, %detail);

      my (@errList);

      # Probable SPAM hosts...

      print "\n--- Admin Policy Blocking ---\n";

      foreach $ThisOne (sort(keys %DontAccept)) {

         # We need this blank.

         $mid = "";

         # IP address/current issue holder.

         $bb = "";

         # Extract exim date and time string...

         ($mdate, $mtime) = ($ThisOne =~ m/^(\d+-\d+-\d+)\s(\d+\:\d+\:\d+)\s/);

         # Link date and time (looks cleaner)...

         $aa = "$mdate $mtime";

         if ( $ThisOne =~ m/do not accept mail from ([\w\*-._]+)@([\w.-_]+)/ ) {

            $cc = "Blocked Email Domain";

            $bb = "$1\@$2";

         }

         elsif ( $ThisOne =~ m/rejected connection in .connect. ACL/ ) {

            $cc = "Blocked Host";

            ( $bb ) = ($ThisOne =~ m/\[(\d+\.\d+\.\d+\.\d+)\]/);

         }

         elsif ( $ThisOne =~ m/mail not permitted from sender ([\w\*-_.]+)@([\w.-_]+)/ ) {

            $cc = "Blocked Email Address";

            $bb = "$1\@$2";

         }

         elsif ( $ThisOne =~ m/contains attached ".(.*)" file, which is blacklisted/ ) {

            $cc = "Blocked Attachment";

            ( $bb ) = ($ThisOne =~ m/\[($IPAddress)\]/);

         }

         elsif ( $ThisOne =~ /believed to be spam/ ) {

            $cc = "Blocked Fragmented Message";

            ( $bb ) = ($ThisOne =~ m/\[($IPAddress)\]/);

         }

         elsif ( $ThisOne =~ /[Ww]arning: dnsbl\.sorbs\.net/ ) {

            $cc = "Blocked by DNSBL (SORBS)";

            ( $bb ) = ($ThisOne =~ m/\[($IPAddress)\]/);

         }

         elsif ( $ThisOne =~ /fragments administratively prohibited/ ) {

            $cc = "Blocked Fragmented Message";

            ( $bb ) = ($ThisOne =~ m/\[($IPAddress)\]/);

         }

         elsif ( $ThisOne =~ m/unqualified sender rejected: <(.*)>/ ) {

            $cc = "Unqualified Sender";

            $bb = "$1";

         }

         elsif ( $ThisOne =~ m/unqualified recipient rejected: <(.*)>/ ) {

            $cc = "Unqualified Receipient";

            $bb = "$1";

         }

         elsif ( $ThisOne =~ m/not accept Windows executables/ ) {

            $cc = "Blocked Attachment";

            ( $bb ) = ($ThisOne =~ m/\[($IPAddress)\]/);

         }

         elsif ( $ThisOne =~ m/remote host address is the local host/ ) {

            $cc = "Invalid local domain";

            ( $bb ) = ($ThisOne =~ m/\@[^>]+/);

         }

         else {

            # If we picked up a malfunction but didn't collect it here,

            # no need to make the user suffer with superfluous error

            # messages.

            #next;

            print "Didn't Summarize: $ThisOne\n";

         }

         if ($cc =~ m/Blocked/ ) {

            # hash of blocked things

            my $h = {};

            if (!defined($detail{$cc})) {

               # debug print "add type $cc\n" ;

               $detail{$cc} = $h;

            }

            $h = $detail{$cc};

            if (defined($h{$bb})) {

               # debug print "add $bb to ".$h{$bb}."\n" ;

               $h{$bb} = $h{$bb} + 1;

            }

            else {

               $h{$bb} = 1;

               # debug print "start $bb at ".$h{$bb}."\n" ;

            }

            # marker

            $spam{$cc} = ""; 

         }

         else {

            if (defined( $spam{$cc} )) {

               $mid = $spam{$cc};

            }

            $spam{$cc} = "$mid$aa : $bb,";

         }

      }

      foreach $ThisOne (sort(keys %spam)) {

         if ($Detail >= $LvlDontAcceptLines) {

            if ($spam{$cc} eq "") {

               print "  $ThisOne\n";

               my $h = $detail{$ThisOne};

               foreach $aa (sort(keys %h) ) {

                  print "    $aa : ".$h{$aa}." times\n";

               }

            }

            else {

               print "  $ThisOne\n";

               foreach $aa ( sort( split /,/, $spam{$ThisOne} )) {

                  print "    $aa\n";

               }

            }

         }

         else {

            @errList = split /,/, $spam{$ThisOne};

            print "  $ThisOne ".scalar @errList." times\n";

         }

      }

   }

}

if ($Detail >= $LvlProtocl) {

# Print Protocol Violations

   if (%Proto) {

      my (%spam);

      # Probable SPAM hosts...

      print "\n--- Bad Hosts ---\n";

      foreach $ThisOne (sort(keys %Proto)) {

         # We need this blank.

         $mid = "";

         # IP address/current issue holder.

         $bb = "";

         $cc = "";

         # Extract exim date and time string...

         ($mdate, $mtime) = ($ThisOne =~ m/^(\d+-\d+-\d+)\s(\d+\:\d+\:\d+)\s/);

         # Link date and time (looks cleaner)...

         $aa = "$mdate $mtime";

         if ( $ThisOne =~ m/SMTP protocol violation\:\s(.*?\(.*?\))\:/ ) {

            $cc = $1;

            ( $bb ) = ($ThisOne =~ m/\[($IPAddress)\]/);

         }

         elsif ( $ThisOne =~ /unexpected disconnection while reading SMTP command/ ) {

            $cc = "Sudden disconnect while expecting remote input";

            ( $bb ) = ($ThisOne =~ m/\[($IPAddress)\]/);

         }

         elsif ( $ThisOne =~ m/rejected ([HE][EH])LO from \[($IPAddress)\]\:\s(.*?):\s(.*?)$/ ) {

            $cc = "Rejected HELO/EHLO: $3";

            $bb = "$2 ($1LO $4)";

         }

         elsif ( $ThisOne =~ /SMTP data timeout \(message abandoned\) on connection from/ ) {

            $cc = "SMTP Timeout errors";

            ( $bb ) = ($ThisOne =~ m/\[($IPAddress)\]/);

         }

         elsif ( $ThisOne =~ /SMTP command timeout on connection from/ ) {

            $cc = "SMTP Timeout errors";

            ( $bb ) = ($ThisOne =~ m/\[($IPAddress)\]/);

         }

         elsif ( $ThisOne =~ /syntactically invalid argument/ ) {

            $cc = "SMTP Syntax errors";

            ( $bb ) = ($ThisOne =~ m/\[($IPAddress)\]/);

         }

         elsif ( $ThisOne =~ /SMTP syntax error in/ ) {

            $cc = "SMTP Syntax errors";

            ( $bb ) = ($ThisOne =~ m/\[($IPAddress)\]/);

         }

         elsif ( $ThisOne =~ /remote host used my name in HELO/ ) {

            $cc = "My name in HELO";

            ( $bb ) = ($ThisOne =~ m/\[($IPAddress)\]/);

         }

         elsif ( $ThisOne =~ /remote host used IP address in HELO/ ) {

            $cc = "IP address in HELO";

            ( $bb ) = ($ThisOne =~ m/\[($IPAddress)\]/);

         }

         elsif ( $ThisOne =~ /incomplete transaction (\(.*\))/ ) {

            $bb = "SMTP transaction cut short $1";

            $SmtpConnection{$bb}++;

         }

         elsif ( $ThisOne =~ /SMTP protocol synchronization error/ ) {

            $bb = "SMTP protocol synchronization error";

            $SmtpConnection{$bb}++;

         }

         elsif ( $ThisOne =~ /dropped: too many nonmail commands/ ) {

            $bb = "Connection dropped after too many nonmail SMTP commands";

            $SmtpConnection{$bb}++;

         }

         elsif ( $ThisOne =~ /dropped: too many syntax or protocol errors/ ) {

            $bb = "Connection dropped after too many syntax/protocol errors";

            $SmtpConnection{$bb}++;

         }

         elsif ( $ThisOne =~ /(SMTP protocol error in \"\w+\")/ ) {

            $bb = $1;

            $SmtpConnection{$bb}++;

         }

         elsif ( $ThisOne =~ /SMTP connection from/ ) {

            if ( $ThisOne =~ /lost while reading message data/ ) {

               $bb = "SMTP connection lost while reading message data";

            }

            elsif ( $ThisOne =~ /Connection reset by peer/ ) {

               $bb = "SMTP connection lost when connection reset by peer ";

            }

            elsif ( $ThisOne =~ /lost/ ) {

               $bb = "SMTP connection lost (non-specific)";

            }

            elsif ( $ThisOne =~ /closed by QUIT/ ) {

               $bb = "SMTP connection closed by QUIT";

            }

            elsif ( $ThisOne =~ /closed after SIGTERM/ ) {

               $bb = "SMTP connection closed after SIGTERM";

            }

            elsif ( $ThisOne =~ /TCP\/IP connection count/ ) {

               $bb = "SMTP connection TCP/IP connection count (warning)";

            }

            if ( $bb ne "" ) {

               $SmtpConnection{$bb}++;

            }

         }

         else {

            # If we picked up a malfunction but didn't collect it here,

            # no need to make the user suffer with superfluous error

            # messages.

            #next;

            print "Didn't Summarize: $ThisOne\n";

         }

         if (defined( $spam{$cc} )) {

            $mid = $spam{$cc};

         }

         # We're picking things up in this larger block that do not

         #  ... fit into this mold, so - let's make sure that this is valid

         #  ... before we set it:

         if (( $cc ne '' ) && ( $bb ne '' )) {

            $spam{$cc} = "$mid$aa : IP:$bb,";

         }

      }

      foreach $ThisOne (sort(keys %spam)) {

         if ($Detail >= $LvlProtoclLines) {

            print " $ThisOne:\n";

            foreach $aa ( sort( split /,/, $spam{$ThisOne} )) {

               print "    $aa\n";

            }

         }

         else {

            @errList = split /,/, $spam{$ThisOne};

            print "  $ThisOne ".scalar @errList." times\n";

         }

      }

      if ( %SmtpConnection ) {

         print "\n--- SMTP Connection Issues \n";

         foreach $ThisOne (keys %SmtpConnection) {

            $bb = $SmtpConnection{$ThisOne};

            print "  $ThisOne: $bb Time(s)\n";

         }

      }

      if (@ReverseLookupH) {

         print "\n--- Failed Reverse Lookups \n";

         print "--- $ReverseLookup  Time(s)\n\n";

         if ($Detail >= $LvlProtoclLines) {

            foreach $ThisOne (@ReverseLookupH) {

               print "   $ThisOne\n";

            }

         }

      }

      if (@LookupH) {

         print "\n--- Failed Reverse Lookups \n";

         print "--- (eg. spam try): $Lookup  Time(s)\n\n";

         if ($Detail >= $LvlProtoclLines) {

            foreach $ThisOne (@LookupH) {

               print "$ThisOne\n";

            }

         }

      }

   }

}

if ($Detail >= $LvlMsgs) {

   # Messages by ID

   if (keys %mmsg ) {

      my $tmsgcount=0;

      my $tmsgrcpts=0;

      print "\n--- Messages history ---\n\n";

      # mmsg is hashed by message id, which is sorted by time

      foreach $tmsg (sort keys %mmsg) {

        my @tmsgkeys = sort {wedlug_liczb} keys %{$mmsg{$tmsg}};

        my $immed_deliv = 1;

        $immed_deliv = 0 unless $tmsgkeys[0] =~ /^\d+ <=/;

        foreach my $key (@tmsgkeys[1..$#tmsgkeys-1]) {

         $immed_deliv = 0 unless $key =~ /^\d+ [-=]>/;

        }

        $immed_deliv = 0 unless $tmsgkeys[$#tmsgkeys] =~ /^\d+ Completed/;

        my $qttmsgcount = 0;

        my $oldqttmsg = '';

        if (!$immed_deliv) {

         print "\-MsgID: $tmsg\: \n";

         foreach $ttmsg (@tmsgkeys) {

             $qttmsg = $ttmsg;

             $qttmsg =~ s/^\d+//; # wywal licznik na poczatku (te od sortowania)

             $qttmsg =~ s/P\=e*smtp S.+//; # wywal koncowki typu:  P=smtp S=372023 id=

             if ($oldqttmsg eq $qttmsg) {

         $qttmsgcount++;

             } else {

         $oldqttmsg = $qttmsg;

         if ($qttmsgcount > 0) {

            print "\tlast message repeated $qttmsgcount times\n";

            $qttmsgcount = 0;

         }

         print "\t$mmsg{$tmsg}{$ttmsg}$qttmsg\n";

             }

         }

         if ($qttmsgcount > 0) {

            print "\tlast message repeated $qttmsgcount times\n";

         }

        } else {

         $tmsgcount++;

         $tmsgrcpts+=$#tmsgkeys-1;

        }

      }

      print "$tmsgcount messages delivered immediately ";

      print "to $tmsgrcpts total recipients\n";

   }

}

# INNE Badziewia

if (keys %OtherList) {

   print "\n**Unmatched Entries**\n";

   foreach $line (sort {$a cmp $b} keys %OtherList) {

      print "$line: $OtherList{$line} Time(s)\n";

   }

}

exit(0);

# vi: shiftwidth=3 tabstop=3 syntax=perl et

# Local Variables:

# mode: perl

# perl-indent-level: 3

# indent-tabs-mode: nil

# End: