stats on how many quarantined mails are released

[IEM]

i would like to tighten my rules, so people get less spam
e.g. if no mail beyond a given threshold has ever been released, i can be pretty confident that I could also just drop those emails, so there's less quarantined emails. (right now, people get a quarantine notification practically each day; if we could reduce that to just once in a while that would be great)
it might also allow me to lower the score for mails to enter the quarantine and see whether it now catches significantly more false positives, without having to wait for angry users to give me feedback that the system started to eat ham mails.


for this i would like to monitor, how many false-positives people encounter (and have to manually release for delivery).

basically i want some stats on how many mails, grouped by score, have been released in a given time.

is this possible?

• via the webinterface?
• via the CLI?
• by doing some manual search in the server-logs?

 

[Stoiko Ivanov]

You can get the information in the server logs - but sadly not as straight forward:
* a released mail will produce a log-line like:

Jun 30 13:12:10 pmg8 pmgdaemon[807]: delivered quarantined mail 'C1R279T155476436' (/var/spool/pmg/cluster/1/spam/61/62174649EB82DAED61)

with the quarantine-file id 62174649EB82DAED61 you can look through the logs to find the pmg-smtp-filter id of the mail:

2023-06-30T13:10:37.724005+02:00 pmg8 pmg-smtp-filter[846]: 620EC649EB82CB7763: moved mail for <test@test.domain> to spam quarantine - 62174649EB82DAED61 (rule: test)

with that id 620EC649EB82CB7763 you'll get the original spam-score

you can potentially spare yourself the second step by creating a rule for each spam-level (all with action quarantine) - then you get the level in the line as rule-name

I hope this helps!