Daily Statistics seem like total for log period...

[peterz]

Hello,
i am using version 2.0.0-1 of MagicSpam for Plesk-11.5/CentOs-6.6-x86/Postfix and it seems like the 'daily' statistics are actually a total for the entire log period (at least, i hope so, because the numbers are staggering)..

if i add up the top 5 senders, i end up with almost all the email sent over the log period (14 days)

i just hope i'm not missing some sort of email hijack of my server..

Here is a screenshot (note: i'm using Safari and the BBCode buttons seem to not be working):
Here is a link to the image to see the entire image

[magicspam]

Hello peterz,

Thank you for your post, and thank you for the information.

What you are seeing is a collective stat from the /var/log/magicspam/mslog file. However, if you are seeing statistics from previous dates, other than the current date, it looks like the cron job is not rotating the logs properly. This could be caused by a number of reasons, for example permission issues, missing user or binary file not defined properly.

Please post what you see when you execute the following command:

Code: Select all

ls -la /var/log/magicspam/

We will continue troubleshooting this when you provide us with the output for the above command. If you run into any errors, please let us know. Thank you!

-- MagicSpam Support Team --

[peterz]

Thank you so much, here is the output:

Code: Select all

[root@host ~]# ls -la /var/log/magicspam/
total 16564
drwxr-xr-x  2 magicspam magicspam     4096 Sep  1 00:01 .
drwxr-xr-x 13 root      root          4096 Sep 13 17:17 ..
-rw-r--r--  1 magicspam magicspam      749 Jan 31  2015 .counter2.dat.01
-rw-r--r--  1 magicspam magicspam      749 Feb 28  2015 .counter2.dat.02
-rw-r--r--  1 magicspam magicspam      749 Mar 31 23:59 .counter2.dat.03
-rw-r--r--  1 magicspam magicspam      749 Apr 30 23:59 .counter2.dat.04
-rw-r--r--  1 magicspam magicspam      749 May 31 23:58 .counter2.dat.05
-rw-r--r--  1 magicspam magicspam      749 Jun 30 23:59 .counter2.dat.06
-rw-r--r--  1 magicspam magicspam      749 Jul 31 23:59 .counter2.dat.07
-rw-r--r--  1 magicspam magicspam      749 Aug 31 23:59 .counter2.dat.08
-rw-r--r--  1 magicspam magicspam      749 Sep 14 23:04 .counter2.dat.09
-rw-r--r--  1 magicspam magicspam      749 Oct 31  2014 .counter2.dat.10
-rw-r--r--  1 magicspam magicspam      749 Nov 30  2014 .counter2.dat.11
-rw-r--r--  1 magicspam magicspam      749 Dec 31  2014 .counter2.dat.12
-rw-r--r--  1 magicspam magicspam      500 Jan 31  2014 .counter.dat.01
-rw-r--r--  1 magicspam magicspam      500 Feb 28  2014 .counter.dat.02
-rw-r--r--  1 magicspam magicspam      500 Mar 31  2014 .counter.dat.03
-rw-r--r--  1 magicspam magicspam      500 Apr 30  2014 .counter.dat.04
-rw-r--r--  1 magicspam magicspam      500 May 31  2014 .counter.dat.05
-rw-r--r--  1 magicspam magicspam      500 Jun 30  2014 .counter.dat.06
-rw-r--r--  1 magicspam magicspam      500 Jul 31  2014 .counter.dat.07
-rw-r--r--  1 magicspam magicspam      500 Aug 31  2014 .counter.dat.08
-rw-r--r--  1 magicspam magicspam      500 Sep 30  2014 .counter.dat.09
-rw-r--r--  1 magicspam magicspam      500 Oct 13  2014 .counter.dat.10
-rw-r--r--  1 magicspam magicspam      500 Nov 30  2013 .counter.dat.11
-rw-r--r--  1 magicspam magicspam      500 Dec 31  2013 .counter.dat.12
-rw-r--r--  1 magicspam magicspam 11787491 Sep 14 23:04 mslog
-rw-r--r--  1 magicspam magicspam   258602 Aug  5 23:54 mslog.1
-rw-r--r--  1 magicspam magicspam   152568 Jul 26 23:59 mslog.10
-rw-r--r--  1 magicspam magicspam   200801 Jul 25 23:55 mslog.11
-rw-r--r--  1 magicspam magicspam   271668 Jul 24 23:59 mslog.12
-rw-r--r--  1 magicspam magicspam   332455 Jul 23 23:59 mslog.13
-rw-r--r--  1 magicspam magicspam   315096 Jul 22 23:56 mslog.14
-rw-r--r--  1 magicspam magicspam   308957 Aug  4 23:59 mslog.2
-rw-r--r--  1 magicspam magicspam   236695 Aug  3 23:59 mslog.3
-rw-r--r--  1 magicspam magicspam   157390 Aug  2 23:58 mslog.4
-rw-r--r--  1 magicspam magicspam   190005 Aug  1 23:59 mslog.5
-rw-r--r--  1 magicspam magicspam   359564 Jul 31 23:59 mslog.6
-rw-r--r--  1 magicspam magicspam  1623135 Jul 30 23:59 mslog.7
-rw-r--r--  1 magicspam magicspam   317518 Jul 28 23:57 mslog.8
-rw-r--r--  1 magicspam magicspam   273226 Jul 27 23:59 mslog.9

[magicspam]

Hello peterz,

Thank you for posting the output.

It looks like the log was not rotating properly, and it looks like it stopped on August 5. We suspect that everything afterwards was appended to the mslog file. Aside from that, the permissions look correct and we can see that it is under the correct group and user ownership ("magicspam").

Our first step is to do the following:

Code: Select all

cat /etc/cron.d/magicspam-update

Locate where it says "# rotate the logs". The entry below should be in the form of:
"0 0 * * * magicspam /usr/share/magicspam/bin/rotate_logs /var/log/magicspam/mslog"

Let us know if you can find the binaries in this folder by executing this command:

Code: Select all

ls -la /usr/share/magicspam/bin/

However, if by any chance you run into an error message, for example a "file/directory not found" error, please let us know.

Please run the two commands and let us know your findings. Thank you!

-- MagicSpam Support Team --

[peterz]

Hello again, and thank you for your help!

I was really more worried that someone had hijacked the server, but that now seems not to be the origin of these numbers..

Here is the output of both commands:

Code: Select all

[root@host ~]# cat /etc/cron.d/magicspam-update
PATH=/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin

# rotate the logs
0 0 * * * magicspam /usr/share/magicspam/bin/rotate_logs /var/log/magicspam/mslog

# clean up old notification entries.
0 0 * * * psaadm /usr/share/magicspam/bin/ms_purge_notifications

# clean up expired rate limiter entries
*/5 * * * * root /usr/share/magicspam/bin/magicspam-rlmanager -c >/dev/null 2>&1
24 4,10,16,22 * * *   psaadm    /usr/share/magicspam/bin/magicspam-updater
[root@host ~]# ls -la /usr/share/magicspam/bin/
total 836
drwxr-xr-x 2 root root   4096 Aug  6 15:02 .
drwxr-xr-x 4 root root   4096 Aug  6 15:01 ..
lrwxrwxrwx 1 root root     37 Aug  6 15:02 activate_plugin -> /usr/share/magicspam/bin/pp_activator
-rwxr-xr-x 1 root root  38112 Aug  6 06:56 bms_update
lrwxrwxrwx 1 root root     37 Aug  6 15:02 deactivate_plugin -> /usr/share/magicspam/bin/pp_activator
lrwxrwxrwx 1 root root     37 Aug  6 15:02 deinit_plugin -> /usr/share/magicspam/bin/pp_activator
-rwxr-xr-x 1 root root   3120 Aug  6 06:56 initdb
lrwxrwxrwx 1 root root     37 Aug  6 15:02 init_plugin -> /usr/share/magicspam/bin/pp_activator
-rwxr-xr-x 1 root root  52260 Aug  6 06:56 license_manager
-rw-r--r-- 1 root root   8006 Aug  6 06:56 magicspam_init
-rwxr-xr-x 1 root root  40552 Aug  6 06:56 magicspam-listmgr
-rwxr-xr-x 1 root root 164528 Aug  6 06:56 magicspam-milter
-rwsr-xr-x 1 root root  98188 Aug  6 06:56 magicspam-rejections
-rwsr-xr-x 1 root root 109056 Aug  6 06:56 magicspam-rlmanager
-rwxr-xr-x 1 root root  43224 Aug  6 06:56 magicspam-stats-converter
-rwxr-xr-x 1 root root 108652 Aug  6 06:56 magicspam-updater
-rwxr-xr-x 1 root root   8691 Aug  6 15:02 ms_notifications_convert_read
-rwxr-xr-x 1 root root   6013 Aug  6 15:02 ms_purge_notifications
-rwsr-xr-x 1 root root  35652 Aug  6 06:56 package-updater
-rwxr-xr-x 1 root root  12283 Aug  6 06:56 postinst
-rwxr-xr-x 1 root root   9413 Aug  6 15:02 post_system_alert
-rwxr-xr-x 1 root root  14525 Aug  6 06:56 pp_activator
-rwxr-xr-x 1 root root   1830 Aug  6 06:56 prerm
-rwsr-xr-x 1 root root  23620 Aug  6 06:56 register
-rwxr-xr-x 1 root root   2070 Aug  6 06:56 rotate_logs
-rwxr-xr-x 1 root root  36144 Aug  6 06:56 update_definitions

[magicspam]

Hello peterz,

It looks like your configuration looks good, and we see nothing wrong with the permissions or user/group issues. One other thing that comes to mind, however, is the permission of magicspam's home directory, which is required to perform the cron job properly. Enter the following command to set the MagicSpam's home directory permission:

Code: Select all

chown magicspam ~magicspam

Let us know if this solves the problem. Otherwise, we will escalate this issue, perhaps through email support.

Thank you for your patience!

-- MagicSpam Support Team --

[peterz]

Hello and thank you!

here are the commands i just ran:

Code: Select all

[root@host home]# ls -la ~magicspam
total 20
drwx------ 2 10019  507 4096 Apr 20  2013 .
drwxr-xr-x 3 root  root 4096 Dec 11  2014 ..
-rw-r--r-- 1 10019  507   18 Feb 21  2013 .bash_logout
-rw-r--r-- 1 10019  507  176 Feb 21  2013 .bash_profile
-rw-r--r-- 1 10019  507  124 Feb 21  2013 .bashrc
[root@host home]# chown magicspam ~magicspam
[root@host home]# ls -la ~magicspam
total 20
drwx------ 2 magicspam  507 4096 Apr 20  2013 .
drwxr-xr-x 3 root      root 4096 Dec 11  2014 ..
-rw-r--r-- 1     10019  507   18 Feb 21  2013 .bash_logout
-rw-r--r-- 1     10019  507  176 Feb 21  2013 .bash_profile
-rw-r--r-- 1     10019  507  124 Feb 21  2013 .bashrc

note: should i have typed:

Code: Select all

chown -R magicspam ~magicspam

[magicspam]

Hello peterz,

Thank you for posting the ls command for magicspam user's home directory (definitely helped a lot). It looks like we found the problem. The permission for magicspam's home directory is set to a non-existing user.

To fix this simply type the following command:

Code: Select all

chown -R magicspam:magicspam ~magicspam

Your stats page should update at midnight.

Execute the above command, and if the problem still persists by tomorrow, please let us know.

Thank you!

-- MagicSpam Support Team --

[peterz]

Dear MagicSpam Support Team,

it worked!

it's possible these permissions were off because i've been using MagicSpam for about 8 years now (+ or -), and have migrated (using the Plesk migration tool) twice in that time.
Though i've not migrated recently, and i've recently upgraded to MagicSpam 2.x (therefore uninstalled, then re-installed), this must be left over from the initial install on the initial server.

In any case, thank you for all your help!
Peter

[magicspam]

Hello peterz,

We are glad the problem is fixed!

We really appreciate your continuing support for MagicSpam, and we are always happy to help you out anytime.

If you run in to any other problems or issues, please let us know.

Thank you!

-- MagicSpam Support Team --