POP3/IMAP Traffic Statics wrong ?

[BeNe]

I checked my Traffic today and found something mysterious.
I have 1 Admin, 1 Reseller and 5 Customers. Not more.
The Admin Static is this one, please take a look at POP3/SMTP Traffic

Here is the Reseller Static, please check also the POP3/SMTP Traffic

How could this be ? No traffic on the one and only Reseller and 5 Customers ?
In that case the Admin and Reseller Traffic should be be the same or not ?

Ok, i use dovecot - but there was a Patch --> http://www.isp-control.net/ispcp/ticket/1597 and the Regex works because the Admin has some Traffic on this Service.

Tested in the current trunk on Debian Lenny.
Does this also happen with Courier ? Can somebody confirm that ?

Greez BeNe

[joximu]

Hi BeNe

I just noticed another strange number.

The statistic in the hetzner robot states a total traffic of around 1/2 GB today (13 hours).
The domain statistic of one customer already has 870MB of POP3/IMAP traffic.

It was a 32MB mail which caused a peak but 870MB POP3/IMAP traffic on one day (half a day) is not really plausible...

Looks like we need to diggg into this mail traffic coounting...

/J

Upd: seems like the customer has downloaded the mail several time later - so the numbers may be correct.

[BeNe]

Yes, this Traffic make absoulte no sense
Let´s find the error...

Greez BeNe

[kilburn]

The mail traffic counter has some counting errors. Long time ago I tried to correct it and almost got it (there was only a single situation left to correct), but then I began working on something else and never commited the changes.

Maybe someone can retake the task...

[BeNe]

Ok, thanks for Info kilburn!

Quote:Maybe someone can retake the task...

Yes we should do this.

Greez BeNe

[BeNe]

I started to debug the wrong Traffic stats.
We talk about ALL TrafficStats in ispCP. In my eyes no traffic is really correct

First i found a bug with a wrong secure smtp Port:
--> http://www.isp-control.net/ispcp/ticket/1770
On check the srv_traff_engine i saw this part:

Code:

if (defined($port) && $port > 0) {

                        $smtp_in += $bytes if ($port == 25);

                        $smtp_in += $bytes if ($port == 456);

                        $pop3_in += $bytes if ($port == 110);

                        $pop3_in += $bytes if ($port == 995);

                        $imap_in += $bytes if ($port == 143);

                        $imap_in += $bytes if ($port == 993);

                        $http_in += $bytes if ($port == 80);

                        $http_in += $bytes if ($port == 443);

An in the OUT Part only the half of the Ports are logged ?

Code:

if (defined($port) && $port > 0) {

            $smtp_out = $bytes if ($port == 25);

            $pop3_out = $bytes if ($port == 110);

            $imap_out = $bytes if ($port == 143);

            $http_out = $bytes if ($port == 80);

It this really correct or are the Ports here missing ?

There is also a differnt between DomainTraffic in ispCP and AWstats.
Ok there *could* be a traffic differnce between both, but we talk about hundreds of MB and GB ?!

Still on the way to find out the error.

Greez BeNe

[BeNe]

Anyone improved the MailTraffic for Dovecot ?
There was a Patch applied in the ispcp-vrl-traff but ONLY for POP3
--> http://www.isp-control.net/ispcp/changes...-vrl-traff

So IMAP, POP3-SSL and IMAP-SSL needs also a patch for Dovecot.
I checked my logfiles and found

Code:

Mar 24 06:32:55 matrix dovecot: imap-login: Login: user=<my@adress.com>, method=PLAIN, rip=88.79.19.XX, lip=66.76.253.XX, TLS

I changed the IMAP Part:

Code:

$rs = sys_command("$cat $rlog|$grep 'imapd'|$grep 'user='|$grep 'body='|$grep -v 'ip=\\[::ffff:127.0.0.1\\]'|$awk '{print \$7,\$9,substr(\$10,1,length(\$10)-1);}' 1>$imap_log");

--> http://www.isp-control.net/ispcp/browser...traff#L698
to

Code:

$rs = sys_command("$cat $rlog|$grep 'imap-login'|$grep 'user='|$grep 'body='|$grep -v 'ip=\\[::ffff:127.0.0.1\\]'|$awk '{print \$7,\$9,substr(\$10,1,length(\$10)-1);}' 1>$imap_log");

The difference is only the imap-login instead of imapd.
I wait now for some Traffic on the IMAP Service and hope that i get some more data.

Can somebody spend more or better improvments ?

Greez BeNe

[kilburn]

Quote:An in the OUT Part only the half of the Ports are logged ?

Code:

$smtp_out = $bytes if ($port == 25);
$pop3_out = $bytes if ($port == 110);
$imap_out = $bytes if ($port == 143);
$http_out = $bytes if ($port == 80);

It this really correct or are the Ports here missing ?

Yes, the secured outgoing ports are missing. This is probably because as ispcp doesn't support secured connections by default, the incoming secured ports counting was added by someone who hit the issue yet never thought about similar outgoing connections.

Quote:The difference is only the imap-login instead of imapd.

Then I would propose using this as a common script for both courier and dovecot imap then:

Code:

$rs = sys_command("$cat $rlog|$grep 'imap'|$grep 'user='|$grep 'body='|$grep -v 'ip=\\[::ffff:127.0.0.1\\]'|$awk '{print \$7,\$9,substr(\$10,1,length(\$10)-1);}' 1>$imap_log");

Greets!

[BeNe]

Ticket created for the secure ports.

Quote:Then I would propose using this as a common script for both courier and dovecot imap then:

Good point!

Greez BeNe

[BeNe]

To all ispCP Users out there: Are your Stats in ispCP right ?
Of course there is traffic counted, but the traffic in not correct in my eyes.

Greez BeNe