Log Analysis, POP3 traffic

[august]

I'm creating some script for XMail log analysis.
I need only calculate traffic for custom users. In SMTP log exists field with size of email for this,
but no in pop logs.

Please help me with this.

And where I can find log format, because i see them in src files

Thank for understanding.

[hschneider]

About the log's format:
http://xmail.eye-catcher.com/products/XMai...Files/index.asp

[august]

Thanks

[dario]

Hi,
You can only calculate what you know for sure and that's what your users have received, but the question is how many times do they read/download the same mail?
Pop3 bandwidth is difficult or maybe impossible to calculate with Xmail logs.
That's because of many situations.
For example you cannot know if your users are keeping their mail on the server for some time (a feature available in outlook and other clients), you could also have a webmail interface which obviously keeps mails on the server but consumes bandwidth each time you read or download an attachment several times. You can also have users never downloading mails.

I've already asked Davide if we could expect in the future a pop3 log with a size field per session, but I still didn't get an answer, maybe it's too long to implement.

[august]

>you cannot know if your users are keeping their mail on the server for some time (a feature available in outlook and other clients)

For this need only size of server reply to client

>you could also have a webmail interface which obviously keeps mails on the server but consumes bandwidth each time you read or download an attachment several times.

I can see IP address for this. (127.0.0.1) or local IP's

>You can also have users never downloading mails.

Yes, but it is not my problem, let sysadmin think about this.

[dario]

Sorry but maybe I didn't get the point,
I thought you wanted to calculate the size of bytes transferred by the pop3 server.

Pop3 logs just tells you that somebody established a connection to the server, it could be anyone including unauthorized people.
Further on if you whant to count n° of pop3 access per user/domain you should check user & pwd fields in the log against mailusers.tab, but that's another story.

>For this need only size of server reply to client
Ok, but where do you get it from? As you said, there is no size field in pop3 logs.

>I can see IP address for this. (127.0.0.1) or local IP's
Same as above

Maybe I'm wrong but as far as I know, the only thing you can do is calculate incoming Smtp and use this value for pop3 traffic size, assuming every body downloaded messages one time only (no: web mail, keep on server, imap etc) and that there is a store to mailbox command.

But if you find a solution to what I'm saying please let me know.