Penguin

Using cacti to graph Exim+ClamAV statistics

NB: This works for me. YMMV.

Use the following PHP script (named script.sh) to get the info outta your logs: http://profiles.nzhondas.com/misc/mailget5.phps

1. Create the cacti Data Input Method. Use a Script/Command Input Type, and provide the link to the script, ie /var/www/cacti/scripts/mailget.sh. Add in Output fields, such as 'notspam', 'total', 'malware', 'rbl', 'sa_spam', and 'spf'.

2. Create a Data Source. Use a 3600 step (hourly stats) and select the Data Input method which you just created. You won't need to specify a data source path as cacti inserts this automatically. After creating the initial source, create Data Source Items for each field. Use a GAUGE Source Type (I had used ABSOLUTE initially but this really wasn't working - most because I didn't read the RRDTOOL documentation properly (especially http://people.ee.ethz.ch/oetiker/webtools/rrdtool/tutorial/rrdbeginners.html). Use a 7200 Heartbeat. Insert a sane maximum value for each field according to how many rbl bounces/spam messages you foresee receiving each hour.

I seemed to have problems if I didn't enter all the details for the data source within 5 minutes (after you add a new Data Source cacti creates the RRA for it each 5 minute cron run). If you find you're having problems with the newly created data source, try changing the filename cacti has automatically created (for example, if it's <path_rra>/spam_1.rrd try <path_rra>/spam_2.rrd. cacti will re-create it on the next crontab run.

Pick the associated Output field for each Data Source Item, and then click Save (you'll need to do this after adding each item).

3. Click on Graph Management, then Add. It's all pretty self-explantory from here. Set the base value as 1000. Don't worry about setting upper or lower limits, as you'll probably want to use auto-scale. After you've created the initial graph, add in Graph Items for each series you wish to graph, picking the appropriate Data Source.