Full report

System Name: mxoskar
system name The name of the system(s) that the report pertains to.
Date and Time: 17-May-2006 09:02:17
date time The time that the report was generated. Not the end interval (see timespan).
Software Version: 5.0
version The software version of the system.
Timespan: [2006-04-13 09:02:00, 2006-05-13 09:02:00] (Generated with offset of 4 days)
Timespan begins at 2006-05-09 10:40 for email data because no prior records exist
timespan The interval of time being reported upon. Graphs over time and summary fields such as top senders are restricted to this
period. It is advisable to ensure that this interval is several hours prior to the report generation time, so that most messages received during the timespan are dealt with, and disposed. Uptime: mxoskar: 62 days, 22:56
uptime The amount of time since the system was last booted.
Filters Applied: None:
filter summary
head comment
head comment A comment can be inserted into the report by editing this field in the report configuration. The location of the
comment in the report can be changed by altering the Order column. Traffic and Filtering Summary
Mail Filter
Month Timespan
(acted upon)
traffic blocking The number of incoming messages (from internal and/or external networks) with a given final action or status.
The different categories are mutually exclusive. The last column is over the report timespan. If no spam or virus scanning is
enabled, messages are not scanned, so are assumed clean. blocking pie chart The ratio of clean and not clean messages over the report timespan (the last column of the traffic blocking
total traffic received The Total Traffic Received graphs show 1) the total incoming messages from internal and external networks,
and 2) the total number of ’passes’ all messages went through (including internal resends due to quarantine, bounce, internally
total traffic sent The Total Traffic Sent graphs show the total messages sent out of the system. Mail sent to multiple recipients
on the same host in the same smtp session are counted as only one send. total received message size The total size of incoming messages per hour.
total sent out message size The total size of messages sent out of the system per hour. When multiple recipients are delivered in
one smtp session to one host, the message is only counted once. Trusted / Untrusted Traffic
Disposition
Month Timespan
trust traffic Trust level ’all’ means trusted plus untrusted. ’clean’ means no enabled scanning or filters matched.The last
column is over the report timespan. processing time The average time a message spends between initial handshake and disposition, including RBL/DCC lookups if any.
Messages which get deferred are not included. spam metrics The first graph is the number of messages detected and acted upon as spam per hour.
This is detected by any enabled anti-spam features (including PBMF type spam)
The second graph is the frequency of STA metrics (for only those messages that were scanned by STA) The ’limit’ parameter in the
report configuration sets the range, to exclude the messages with metric values near 0 and 100. e.g 96 selects the 96 values
Top Virus List
Virus Name
top virus The most commonly detected virus types. The limit parameter in the report configuration sets the maximum number listed.
More than one virus may be detected per email but only one is recorded in the reporting database. Recent Virus List
Envelope From
Intended Recipient
Received
recent virus list A list of the most recent email which contained a virus. The limit parameter in the report configuration sets
the maximum number listed. Only one intended recipient is listed. Recipient filters are not applied to this table, but Sender
filters are. The most commonly detected pattern based message filters. The limit parameter in the report configuration sets the
Top Pattern Based Message Filters
top PBMFs The most commonly detected pattern based message filters. The limit parameter in the report configuration sets the
Top Forbidden Attachments
Attachment Type
top forbidden attachments The most commonly detected forbidden attachment types. The limit parameter in the report configuration
sets the maximum number listed. More than one forbidden attachment may be detected per email but only one is recorded in the
Recent Forbidden Attachments
Attachment
Envelope From
Intended Recipient
Received
recent forbidden attachments A list of the most recent email which contained a forbidden attachment. The limit parameter in the
report configuration sets the maximum number listed. Only one intended recipient is listed. Recipient filters are not applied to
this table, but Sender filters are. The most commonly detected virus types. The limit parameter in the report configuration sets
the maximum number listed. More than one virus may be detected per email but only one is recorded in the reporting database. Disk Usage
Disk Part
Directory
disk usage The amount of data used and total size of each partition, and percent used. All partitions should be kept below 90%
disk load The number of megabytes transfered (read or written) per second, averaged for each hour. This is estimated from
discrete measurements taken every 5 minutes. CPU load The hourly average number of processes waiting for CPU time. This is averaged from 5 minute values reported by the
kernel, taken every 5 minutes. A busy system will routinely get to 3 to 6, an overloaded system might show 20 to 50 or more NIC load The amount of data (Megabytes) read by each active interface, per hour.
swap usage The maximum amount of swap spage (Megabytes) in use within the hour. This is estimated from discrete measurements
paging The maximum number of pages swapped in and out within a 5 second interval, within the hour. This is estimated from
discrete measurements taken every 5 minutes. Top Mailbox Users
top mailbox sizes The list of largest locally stored mailbox sizes, as of the time the report was generated (not the end of the
report timespan). The limit parameter in the report configuration sets the maximum number listed. WebMail The number of WebMail logins, and failed attempts, per hour. This does not include ’admin’ logins.
pop The number of pop mail accesses, and failed attempts, per hour. One access usually downloads all available messages for one
imap The number of imap mail accesses, and failed attempts, per hour.
active mail queue The maximum hourly size of the active mail queue. This is estimated from discrete measurements taken every 5
minutes. After handshake with sender, message reception, and spam and virus scanning are complete messages are put into the
active queue. They await their turn for delivery, then are disposed, or deferred due to inability to send onward. This queue can
grow arbitrarily but should decrease on a regular basis. deferred mail queue The maximum hourly size of the deferred mail queue. This is estimated from discrete measurements taken every
5 minutes. Messages are deferred only if they are unable to be sent onward (e.g. when recipient host is down). Deferred messages
are intermittently put back onto the active queue for retries. This queue can grow arbitrarily but should decrease regularly. Top Senders
Envelope From
Messages
top senders The top sender (judged by envelope from, not header from) during the report timespan, ordered by the total number of
messages sent. The number of messages is also listed. The limit parameter in the report configuration sets the maximum number
Top Sending Hosts
Sender FQDN
Sender IP
Messages
top sending hosts The top sender fqdn (Fully Qualified Domain Name) during the report timespan, ordered by the total number of
messages sent. The number of messages is also listed. The limit parameter in the report configuration sets the maximum number
Top Recipients
Recipient
Messages
[email protected] top recipients The top recipients during the report timespan, ordered by the total number of messages sent. The sum of the
message sizes is also listed. The limit parameter in the report configuration sets the maximum number listed. DCC servers The hourly average round trip time for preferred DCC server query. The preferred Distributed Checksum Clearinghouse
server is used for bulk mail lookup. DCC server performance is constantly monitored and the preferred server can change hourly. RBL servers The average round trip time for real time blackhole list lookups.

Source: http://www.oskarshamn.se/upload/rep55.pdf