Better Living Through Thinking

histospam - a spam histogram from procmail logs

Fri, 22 Jul 2005

histospam is a program that creates a histogram of email messages received by procmail.

Output is in the format:

yyyymmdd => ***... (message count)

Sample usage:

histospam procmail.log

Sample output:

20040429 => ********************************************* (227)
20040430 => ************************************************* (245)
20040501 => *********************************** (177)
20040502 => ***************************************** (208)
20040503 => *********************** (118)
20040504 => *********** (58)
20040505 => ************ (62)
20040506 => *********** (55)
20040507 => ******** (44)
20040508 => ********** (53)
20040509 => ********* (45)
20040510 => ********* (46)
20040511 => *********** (56)

Source code:

Copy and paste the following script into a file named "histospam", then chmod 0755 histospam. You might need to change the path to perl on your system. You may wish to change the $scale variable. The $scale variable determines how many messages an asterisk represents.

#!/usr/bin/perl -an

## histospam: a procmail log analyzer
## by Scott Wiersdorf

BEGIN {
    $scale = 5;  ## change this
    %mon = map { $_ => ++$i } qw(Jan Feb Mar Apr May Jun Jul Aug Sep Oct Nov Dec);
}

if( /^From \S+\s+\w{3} (\w{3})  ?(\d+) [\d:]+ (\d{4})/ ) {
    $log{sprintf("%4d%02d%02d", $3, $mon{$1}, $2)}++;
}

END {
    printf "%s => %s (%d)\n", $_, "*"x($log{$_}/$scale), $log{$_} for sort keys %log;
}

Author: Scott Wiersdorf, scott at p e r l c o d e dot o r g

License: histospam is released under the Perl Artistic License.