On Sun, Oct 26, 2003 at 07:37:21AM -0800, Richard Pitt wrote:
|
| The other alternative is something like syslogd where it shows only a
| count if the activities are identical and come close to one another.
so we have some people who want one report per incident, some who want a
max of 48 reports per day, and personally i think a max of one per day
would be appropriate. people who publish a "report" directive are
asking someone to do them a favour. we should make that favour as easy
as possible. the easiest thing for me would be a cron job that greps
for SPF reject lines in syslog and mails out a summary.
we could add a report:NN:email-address, where if NN is 0 you get one
report per incident, if it's 1 you get one report per day, and if it's
48 one report per half hour or whatever.
but really the point of the report is to know when your legitimate users
are all in the fold; knowing when joe-jobs happen isn't very useful.
which is why i thought once every 24 hours would be good enough.
-------
Sender Permitted From: http://spf.pobox.com/
Archives at http://archives.listbox.com/spf-discuss/current/
Latest draft at http://spf.pobox.com/draft-mengwong-spf-02.txt
To unsubscribe, change your address, or temporarily deactivate your
subscription,
please go to
http://v2.listbox.com/member/?listname(_at_)©#«Mo\¯HÝÜîU;±¤Ö¤Íµø?¡