On Tue, 20 Jan 2004, Gerardo Gregory wrote:

Yup :).

That's right. If you have a look at RFC 2821, you'll see:

--------- 550 Requested action not taken: mailbox unavailable (e.g., mailbox not found, no access, or command rejected for policy reasons)

---------

Now note the one about policy reasons. This includes things like Spam/Virus Denied, and probably a bunch of other things. Basically, the problem(?) is that the code is generic enough to represent a wide range of failures. This is both a strength and a weakness. It's a strength in that if people need a new error code (like when implementing a spam filter) they can just use that. But it's also a weakness in that parsing results is a pain :). The RFC will give you the general description, but your logs will give you the specifics. You'd probably want something like (excuse my perl):

%errors = ( ... '550' => { 'Spam or virus' => [ '(spam|virus|whitelist)' ], 'User unknown' => [ '((recipient|user).*?unknown|mailbox.*?not found)' ], ... } )

then you'd use this pseudo-perl to eg. total the number of each different type of message.

# Somewhere above we have a loop for the errors, which sets $errno and # $errtext, and has a label NEXTERR if($errno == 550) { $errcoll = $errors{$errno}; foreach $type (keys %{ $errcoll } ) { foreach $regex (@{ $errcoll->{$type} }) { if($errtext =~ /$regex/) { $types{$type}++; next NEXTERR; } } } push @unknowns, $errtext; }

Hope that helps.