Milter-greylist

> -----Original Message-----
> From: milter-greylist@yahoogroups.com [mailto:milter-
> greylist@yahoogroups.com] On Behalf Of Radovan Mzik
> Sent: Wednesday, October 07, 2009 10:39 AM
> To: milter-greylist@yahoogroups.com
> Subject: RE: [milter-greylist] Is greylisting still a valid technique?
> 
> > >
> > > root@mx ~]# grep -c "delayed for" /var/log/maillog
> > > 23231
> > > [root@mx ~]# grep -c "autowhitelisted" /var/log/maillog
> > > 658
> > >
> > > Make sure you're looking for the right data.
> > >
> >
> > How is "delayed for" greater than "autowhitelisted"? "delayed for"
> > indicates a previously unseen host that was delayed but then retried.
> 
> it's not true, it's logged even for the first time. So there is no
> indication that the host retried if you are not checking the interval
> value in the logfile.
> 

True, it is logged even for the first attempt.

> > "autowhitelisted" should match on all hosts that have been seen
> > before.
> 
> yes, and this is the way greylisting works. Autowhitelisted entry in
> the logfile indicates that the sender retried after greylisting period or
> was autowhitelisted before.
> 

An autowhitelisted entry occurs each time a host sends mail and for each
recipient, so I think maybe we can't rely on these counts as much as I
previously thought.  I'd still like to figure out why my numbers are
congruent with the OP yet seem to vary wildly to the stats others have
posted.

#grep -c "delayed for" /var/log/maillog
1398

#grep -c "Greylisting in action" /var/log/maillog
1398

#grep -c autowhitelisted /var/log/maillog
8138



Jason A. Bertoch
Network Administrator
jason@...
Electronet Broadband Communications
3411 Capital Medical Blvd.
Tallahassee, FL 32308
(V) 850.222.0229 (F) 850.222.8771