This script will print out a list of IP addresses that have connected via smtp at least 100 times. This was very useful for me as I found two IP addressed that were filling up my queues with nearly 10,000 messages each over the span of 2 days!
Code: Select all
grep smtp /var/log/secure | grep -oe '[[:digit:]]\+\.[[:digit:]]\+\.[[:digit:]]\+\.[[:digit:]]\+' \
| sort | uniq -c | grep -e '^[[:space:]]*[[:digit:]]\{3,\}[[:space:]]\+[[:digit:]]'
Code: Select all
/sbin/iptables -A INPUT -s 80.99.151.140 -j DROP
Hope that helps somebody out there.