postfix_exporter/lib/collector/postfix.rb

416 lines
23 KiB
Ruby

class Collector::Postfix
class Noqueue
def initialize store, prometheus
@store = store
@noqueue = prometheus.counter :total, docstring: 'Total noqueued by reasons.', labels: %i[reason]
@codes = prometheus.counter :status_code_total, docstring: 'Total noqueued by status code', labels: %i[status_code enhanced_status_code]
['dnsbl', 'no reverse hostname', 'user does not exist', '<any>'].each {|r| @noqueue.increment by: 0, labels: {reason: r} }
end
def collect entry
case entry.message
when /\ANOQUEUE: reject: RCPT from (?:[^ ]+): (\d+) (\d+\.\d+\.\d+) (?:[^ ]+): (.*?),/
code, enh = $1, $2
@codes.increment labels: {status_code: code, enhanced_status_code: enh}
end
case entry.message
when /\ANOQUEUE: reject: RCPT from .* blocked using /
@noqueue.increment labels: {reason: 'dnsbl'}
when /\ANOQUEUE: reject: RCPT from .* Message rejected due to: SPF fail - not authorized\. /
@noqueue.increment labels: {reason: 'spf fail'}
when / Client host rejected: cannot find your reverse hostname/
@noqueue.increment labels: {reason: 'no reverse hostname'}
when / User doesn't exist: /
@noqueue.increment labels: {reason: 'user does not exist'}
else
STDERR.puts "# #{entry._systemd_unit} #{entry.syslog_identifier} NOQUEUE: #{entry.message}"
@noqueue.increment labels: {reason: '<any>'}
end
end
end
class Cache
def initialize store, prometheus
@store = store
@full_cleanup = prometheus.counter :full_cleanup_total, docstring: 'A counter of total cache cleanups', labels: %i[file]
@full_cleanup_retained = prometheus.gauge :full_cleanup_retained_entries, docstring: 'Retained entries of last cache cleanups', labels: %i[file]
@full_cleanup_dropped = prometheus.counter :full_cleanup_dropped_entries_total, docstring: 'Total dropped entries of cache cleanups', labels: %i[file]
end
def collect entry
case entry.message
when /\Acache (.*) full cleanup: retained=(\d+) dropped=(\d+) entries/
# postscreen: cache lmdb:/var/lib/postfix/postscreen_cache full cleanup: retained=128 dropped=14 entries
file, retained, dropped = $1, $2.to_f, $3.to_f
@full_cleanup.increment labels: {file: file}
@full_cleanup_retained.increment by: retained, labels: {file: file}
@full_cleanup_dropped.increment by: dropped, labels: {file: file}
else
STDERR.puts "# #{entry._systemd_unit} #{entry.syslog_identifier} cache: #{entry.message}"
end
end
end
class Postscreen
def initialize store, prometheus
@store = store
@noqueue = Noqueue.new store, prometheus.prefix_proxy( :noqueue)
@cache = Cache.new store, prometheus.prefix_proxy( :cache)
@connect_from = prometheus.counter :connect_from_total, docstring: 'A counter of connections to postscreen'
@whitelisted = prometheus.counter :whitelisted_total, docstring: 'A counter of WHITELISTED connections to postscreen'
@pass_old = prometheus.counter :pass_old_total, docstring: 'A counter of PASS OLD connections to postscreen'
@pass_new = prometheus.counter :pass_new_total, docstring: 'A counter of PASS NEW connections to postscreen'
@dnsbl = prometheus.counter :dnsbl_total, docstring: 'A counter of DNSBL-blocked to postscreen'
@bare_newline = prometheus.counter :bare_newline_total, docstring: 'A counter of BARE NEWLINE-blocked to postscreen'
@command_pipelining = prometheus.counter :command_pipelining_total, docstring: 'A counter of COMMAND PIPELINING-blocked to postscreen'
@command_time_limit = prometheus.counter :command_time_limit_total, docstring: 'A counter of COMMAND TIME LIMIT-blocked to postscreen'
@hangup = prometheus.counter :hangup_total, docstring: 'A counter of HANGUP to postscreen'
@bdat = prometheus.counter :bdat_total, docstring: 'A counter of BDAT to postscreen'
@pregreet = prometheus.counter :pregreet_total, docstring: 'A counter of PREGREET to postscreen'
@disconnect = prometheus.counter :disconnect_total, docstring: 'A counter of DISCONNECT to postscreen'
@unknown = prometheus.counter :unknown_total, docstring: 'A counter of unknown loglines by postscreen'
@warnings = prometheus.counter :warnings_total, docstring: 'A counter of any warnings'
@psc_cache_update_delay = prometheus.summary :psc_cache_update_delay_total, docstring: 'A counter of PSC cache update delays by file', labels: %i[file]
@curr_unavailable = prometheus.counter :service_currently_unavailable_total, docstring: 'A counter for rejected mails, because service currently unavailable - so greylisted.'
@dnsblog_reply_timeout = prometheus.counter :dnsblog_reply_timeout_total, docstring: 'Total timedout requests for dnsblog'
@data_without_valid_rcpt = prometheus.counter :data_without_valid_rcpt_total, docstring: 'A counter of DATA without valid RCPT events'
end
def collect entry
#STDERR.puts "postscreen: #{entry.message}"
case entry.message
when /\ACONNECT from / then @connect_from.increment
when /\AWHITELISTED / then @whitelisted.increment
when /\APASS OLD / then @pass_old.increment
when /\APASS NEW / then @pass_new.increment
when /\ADISCONNECT / then @disconnect.increment
when /\APREGREET / then @pregreet.increment
when /\ABDAT / then @bdat.increment
when /\AHANGUP / then @hangup.increment
when /\ADNSBL rank / then @dnsbl.increment
when /\ABARE NEWLINE / then @bare_newline.increment
when /\ACOMMAND PIPELINING / then @command_pipelining.increment
when /\ACOMMAND TIME LIMIT / then @command_time_limit.increment
when /\ADATA without valid RCPT / then @data_without_valid_rcpt.increment
when /\Acache / then @cache.collect entry
when /\ANOQUEUE: (.*)/
case msg = $1
when /\Areject: RCPT from [^ ]+: 450 4.3.2 Service currently unavailable; /
@curr_unavailable.increment
else
@noqueue.collect entry
end
when /\Awarning: (.*)/
@warnings.increment
case $1
when /\Apsc_cache_update: ([^ ]+) update average delay is ([^ ]+)/
@psc_cache_update_delay.observe $2.to_f, labels: {file: $1}
when /\Adnsblog reply timeout /
@dnsblog_reply_timeout.increment
when /\Agetpeername: Transport endpoint is not connected -- dropping this connection/
else
STDERR.puts "# postscreen warnings: #{entry.message}"
end
else
STDERR.puts "# postscreen: #{entry.message}"
@unknown.increment
end
end
end
def self.tls_posibilities
%w[Trusted Untrusted Anonymous].each do |trust|
%w[TLSv1.2 TLSv1.3].each do |tls|
%w[TLS_AES_128_GCM_SHA256 TLS_AES_256_GCM_SHA384 ECDHE-RSA-AES128-GCM-SHA256 ECDHE-RSA-AES256-GCM-SHA384].each do |cipher|
yield trust, tls, cipher
end
end
end
end
class Smtp
def initialize store, prometheus
@store = store
@connection_refused = prometheus.counter :connection_refused_total, docstring: 'A counter of refused connections on smtp'
@connection_timed_out = prometheus.counter :connection_timed_out_total, docstring: 'A counter of timed out connections on smtp'
@tls = prometheus.counter :tls_total, docstring: 'A counter of TLS connections on smtp with TLS-version and cipher', labels: %i[trust tls cipher]
Collector::Postfix.tls_posibilities {|t, s, c| @tls.increment by: 0, labels: {trust: t, tls: s, cipher: c} }
@status = prometheus.histogram :status, docstring: 'A histogram of message status by status', labels: %i[status]
@sent = prometheus.counter :sent_total, docstring: 'A counter of sent messages by smtp'
@deferred = prometheus.counter :deferred_total, docstring: 'A counter of deferred messages by smtp'
@bounced = prometheus.counter :bounced_total, docstring: 'A counter of bounced messages by smtp'
@deliverable = prometheus.counter :deliverable_total, docstring: 'A counter of deliverable messages by smtp'
@undeliverable = prometheus.counter :undeliverable_total, docstring: 'A counter of undeliverable messages by smtp'
@status_unknown = prometheus.counter :status_unknown_total, docstring: 'A counter of unknown status by smtp'
@unknown = prometheus.counter :unknown_total, docstring: 'A counter of unknown loglines by smtp'
end
def collect entry
#STDERR.puts "smtp: #{entry.message}"
case entry.message
when /\Aconnect to /
case entry.message
when / Connection refused\z/ then @connection_refused.increment
when / Connection timed out\z/ then @connection_timed_out.increment
else
STDERR.puts "# #{entry._systemd_unit} #{entry.syslog_identifier} connect to: #{entry.message}"
end
when /\A([^ ]+) TLS connection established to .* ([^ ]+) with cipher ([^ ]+)/
@tls.increment labels: {trust: $1, tls: $2, cipher: $3}
when /\A\w+: .* delay=([0-9.]+),.*status=([^ ]+)/
# postfix@-.service: postfix/smtp/smtp 4KZ0KY5Wx4z4Mn: to=<wegmann@psi.co.at>, relay=mail.psi.co.at[81.223.32.197]:25, delay=0.76, delays=0.2/0/0.35/0.21, dsn=2.0.0, status=sent (250 2.0.0 Ok: queued as 710F7A0263)
delay, status = $1.to_f, $2.downcase
@status.observe delay, labels: {status: status}
case status
when 'sent' then @sent.increment
when 'deferred' then @deferred.increment
when 'bounced' then @bounced.increment
when 'deliverable' then @deliverable.increment
when 'undeliverable' then @undeliverable.increment
else
STDERR.puts "# #{entry._systemd_unit} #{entry.syslog_identifier} status: #{entry.message}"
@status_unknown.increment
end
else
STDERR.puts "# #{entry._systemd_unit} #{entry.syslog_identifier}: #{entry.message}"
@unknown.increment
end
end
end
class Smtpd
def initialize store, prometheus
@store = store
@noqueue = Noqueue.new store, prometheus.prefix_proxy( :noqueue)
@connect_from = prometheus.counter :connect_from_total, docstring: 'A counter of connections to smtpd', labels: %i[from_unknown]
%w[0 1].each {|x| @connect_from.increment by: 0, labels: {from_unknown: x} }
@tls = prometheus.counter :tls_total, docstring: 'A counter of TLS connections to smtpd with TLS-version and cipher', labels: %i[trust tls cipher]
Collector::Postfix.tls_posibilities {|t, s, c| @tls.increment by: 0, labels: {trust: t, tls: s, cipher: c} }
@disconnect_from = prometheus.counter :disconnect_from_total, docstring: 'A counter of "disconnect from" to smtpd'
@disconnect_from_events = prometheus.counter :disconnect_from_event_total, docstring: 'A counter of events while connection-lifetime (auth, starttls, mail, rcpt, data, commands, ...) from disconnections', labels: %i[event]
%w[auth mail rcpt data commands starttls ehlo quit].each {|e| @disconnect_from_events.increment by: 0, labels: {event: e} }
@concurrenty_limit_exceeded = prometheus.counter :concurrenty_limit_exceeded_total, docstring: 'A counter of concurrenty limit exceeded connections to smtpd'
@timeout = prometheus.counter :timeout_connection_total, docstring: 'A counter of timedout connections to smtpd', labels: %i[after]
@lost_connection = prometheus.counter :lost_connection_total, docstring: 'A counter of lost connections to smtpd', labels: %i[after]
@accepted = prometheus.counter :accepted_total, docstring: 'A counter of accepted messages to smtpd'
@unknown = prometheus.counter :unknown_total, docstring: 'A counter of unknown loglines by smtpd'
@sasl_auth_failed = prometheus.counter :sasl_auth_failed_total, docstring: 'A counter of failed SASL authentication by method', labels: %i[method]
@non_smtp_command = prometheus.counter :non_smtp_command_total, docstring: 'A counter of Non-SMTP-commands (ex. was a HTTP GET / HTTP/1.1)'
@tls_lib_problem = prometheus.counter :tls_lib_problem_total, docstring: 'A counter of TLS libreary problems (ex. unsupported protocol'
@ssl_error = prometheus.counter :ssl_error_total, docstring: 'A counter of any SSL_accept errors by error', labels: %i[error]
@warnings = prometheus.counter :warnings_total, docstring: 'A counter of any warnings'
%w[].each {|m| @sasl_auth_failed.increment by: 0, labels: {method: m} }
@hostname_not_resolved_to_address = prometheus.counter :hostname_not_resolved_to_address_total, docstring: 'A counter of hostnames, which cannot be resolved to there IP'
end
def collect entry
#STDERR.puts "smtpd: #{entry.message}"
case entry.message
when /\Aconnect from unknown/
@connect_from.increment labels: {from_unknown: 1}
when /\Aconnect from /
@connect_from.increment labels: {from_unknown: 0}
when /\A([^ ]+) TLS connection established from .*: ([^ ]+) with cipher ([^ ]+) /
@tls.increment labels: {trust: $1, tls: $2, cipher: $3}
when /\ANOQUEUE: /
@noqueue.collect entry
when /\Adisconnect from ([^ ]+) (.*)/
@disconnect_from.increment
# ehlo=2 starttls=1 auth=1 mail=1 rcpt=1 data=1 commands=8
$2.split( ' ').each do |x|
case x
when /(\w+)=(\d+)/
@disconnect_from_events.increment by: $2.to_f, labels: {event: $1}
else
STDERR.puts "# #{entry._systemd_unit} #{entry.syslog_identifier} disconnect from: [#{x}] #{entry.message}"
end
end
when /\Awarning: (.*)/
@warnings.increment
case $1
when /\AConnection concurrency limit exceeded: /
@concurrenty_limit_exceeded.increment
when /\Ahostname ([^ ]+) does not resolve to address /
@hostname_not_resolved_to_address.increment
when /\A[^ ]+\[([^ ]+)\]: SASL ([^ ]+) authentication failed/
@sasl_auth_failed.increment labels: {method: $1.downcase}
when /\Anon-SMTP command from /
@non_smtp_command.increment
when /\ATLS library problem /
@tls_lib_problem.increment
else
STDERR.puts "# #{entry._systemd_unit} #{entry.syslog_identifier} wanring: #{entry.message}"
end
when /\ASSL_accept error from [^ ]+: (-?\d)/
@ssl_error.increment labels: {error: $1.to_i}
when /\Atimeout after ([^ ]+) from /
@timeout.increment labels: {after: $1}
when /\Alost connection after ([^ ]+) from /
@lost_connection.increment labels: {after: $1}
when /\A\w{8,15}: client=/ # sasl_method=
@accepted.increment
else
STDERR.puts "# #{entry._systemd_unit} #{entry.syslog_identifier}: #{entry.message}"
@unknown.increment
end
end
end
class Tlsproxy
def initialize store, prometheus
@store = store
@connect = prometheus.counter :connect_total, docstring: 'A counter of COUNNECT from tlsproxy'
@disconnect = prometheus.counter :disconnect_total, docstring: 'A counter of DISCOUNNECT from tlsproxy'
@tls = prometheus.counter :tls_total, docstring: 'A counter of TLS connections to smtpd with TLS-version and cipher', labels: %i[trust tls cipher]
Collector::Postfix.tls_posibilities {|t, s, c| @tls.increment by: 0, labels: {trust: t, tls: s, cipher: c} }
end
def collect entry
case entry.message
when /\ADISCONNECT / then @disconnect.increment
when /\ACONNECT / then @connect.increment
when /\A([^ ]+) TLS connection established from .*: ([^ ]+) with cipher ([^ ]+) /
@tls.increment labels: {trust: $1, tls: $2, cipher: $3}
else
STDERR.puts "# #{entry._systemd_unit} #{entry.syslog_identifier}: #{entry.message}"
end
end
end
class Bounce
def initialize store, prometheus
@store = store
@non_delivery = prometheus.counter :sender_non_delivery_notification, docstring: 'A counter of notifications to sender because mail cannot deliveried'
end
def collect entry
case entry.message
when /\A([^ ]+): sender non-delivery notification: (.+)/
# postfix@-.service: postfix/bounce/bounce 4L3cN05mX6zfB: sender non-delivery notification: 4L3cN06Qpkz4Fc
@non_delivery.increment
else
STDERR.puts "# #{entry._systemd_unit} #{entry.syslog_identifier}: #{entry.message}"
end
end
end
class SCache
def initialize store, prometheus
@store = store
@start = prometheus.gauge :start, docstring: 'Start timestamp of SCache statistics'
@domain_lookup_hits = prometheus.counter :domain_lookup_hits_total, docstring: 'Count of hits for domain lookups of SCache'
@domain_lookup_miss = prometheus.counter :domain_lookup_miss_total, docstring: 'Count of misses for domain lookups of SCache'
@domain_lookup_success_rate = prometheus.gauge :domain_lookup_success_rate, docstring: 'Success rate of domain lookups of SCache'
@max_simultaneaus_domains = prometheus.gauge :max_simultaneaus_domains, docstring: 'Max simultaneaus connections Domains of SCache'
@max_simultaneaus_addresses = prometheus.gauge :max_simultaneaus_addresses, docstring: 'Max simultaneaus connections Addresses of SCache'
@max_simultaneaus_connections = prometheus.gauge :max_simultaneaus_connections, docstring: 'Max simultaneaus connections of SCache'
end
def collect entry
case entry.message
when /\Astatistics: start interval (.*)/
# postfix@-.service: postfix/scache/scache statistics: start interval Apr 13 10:58:06
@start.set Time.parse( $1).to_f
when /\Astatistics: domain lookup hits=(\d+) miss=(\d+) success=(\d+)%/
# postfix@-.service: postfix/scache/scache statistics: domain lookup hits=2 miss=4 success=33%
@domain_lookup_hits.increment by: $1.to_f
@domain_lookup_miss.increment by: $2.to_f
@domain_lookup_success_rate.set $3.to_f/100
when /\Astatistics: max simultaneous domains=(\d+) addresses=(\d+) connection=(\d+)/
# postfix@-.service: postfix/scache/scache statistics: max simultaneous domains=1 addresses=1 connection=4
@max_simultaneaus_domains.set $1.to_f
@max_simultaneaus_addresses.set $2.to_f
@max_simultaneaus_connections.set $3.to_f
else
STDERR.puts "# #{entry._systemd_unit} #{entry.syslog_identifier}: #{entry.message}"
end
end
end
class Verify
def initialize store, prometheus
@store = store
@cache = Cache.new store, prometheus.prefix_proxy( :cache)
end
def collect entry
case entry.message
when /\Acache / then @cache.collect entry
else
STDERR.puts "# #{entry._systemd_unit} #{entry.syslog_identifier}: #{entry.message}"
end
end
end
def initialize store, prometheus
@store = store
@postscreen = Postscreen.new store, prometheus.prefix_proxy( :postscreen)
@smtp = Smtp.new store, prometheus.prefix_proxy( :smtp)
@smtpd = Smtpd.new store, prometheus.prefix_proxy( :smtpd)
@submission = Smtpd.new store, prometheus.prefix_proxy( :submission)
@tlsproxy = Tlsproxy.new store, prometheus.prefix_proxy( :tlsproxy)
@scache = SCache.new store, prometheus.prefix_proxy( :scache)
@bounce = Bounce.new store, prometheus.prefix_proxy( :bounce)
@verify = Verify.new store, prometheus.prefix_proxy( :verify)
@qmgr = prometheus.counter :qmgr_total, docstring: 'A counter of qmgr actions'
@cleanup = prometheus.counter :cleanup_total, docstring: 'A counter of cleanup actions'
@lmtp = prometheus.counter :lmtp_total, docstring: 'A counter of ltmp actions'
@pickup = prometheus.counter :pickup_total, docstring: 'A counter of pickup actions'
@dnsblog = prometheus.counter :dnsblog_total, docstring: 'A counter for DNS-Blacklisted IP by DNSBL', labels: %i[dnsbl]
@spf_fail = prometheus.counter :spf_fail_total, docstring: 'A counter of policyd-SPF failed SPF'
@spf = prometheus.counter :spf_total, docstring: 'A counter of prepended SPF header-lines with state', labels: %i[status]
%w[pass none].each {|s| @spf.increment by: 0, labels: {status: s} }
@anvil_max_connection_rate_per_minute = prometheus.gauge :anvil_max_connection_per_minute_rate, docstring: "Rate of max connections per minute to listener", labels: %i{listener}
@anvil_max_connection_count = prometheus.gauge :anvil_max_connection_count, docstring: "Count of max connections to listener", labels: %i{listener}
@anvil_max_cache_size = prometheus.gauge :anvil_max_cache_size, docstring: "Current max cache size"
end
def collect entry
#STDERR.puts "postfix: #{entry.syslog_identifier}: #{entry.message}"
case entry.syslog_identifier
when 'postfix/tlsproxy', 'postfix/tlsproxy/tlsproxy' then @tlsproxy.collect entry
when 'postfix/postscreen', 'postfix/smtp/postscreen' then @postscreen.collect entry
when 'postfix/smtp', 'postfix/smtp/smtp' then @smtp.collect entry
when 'postfix/smtpd', 'postfix/smtpd/smtpd' then @smtpd.collect entry
when 'postfix/submission/smtpd' then @submission.collect entry
when 'postfix/bounce', 'postfix/bounce/bounce' then @bounce.collect entry
when 'postifx/verify', 'postfix/verify/verify' then @verify.collect entry
when 'postfix/cleanup', 'postfix/cleanup/cleanup' then @cleanup.increment
when 'postfix/qmgr', 'postfix/qmgr/qmgr' then @qmgr.increment
when 'postfix/lmtp', 'postfix/lmtp/lmtp' then @lmtp.increment
when 'postfix/pickup', 'postfix/pickup/pickup' then @pickup.increment
when 'postfix/scache', 'postfix/scache/scache' then @scache.collect entry
when 'postfix/dnsblog', 'postfix/dnsblog/dnsblog'
case entry.message
when /\Aaddr [^ ]+ listed by domain ([^ ]+) as /
@dnsblog.increment labels: {dnsbl: $1.downcase}
else
STDERR.puts "# #{entry._systemd_unit} #{entry.syslog_identifier}: #{entry.message}"
end
when 'postfix/anvil', 'postfix/anvil/anvil'
case entry.message
when /\Astatistics: max connection rate (\d+)\/60s for \((.+)\) at (.*)/
@anvil_max_connection_rate_per_minute.set $1.to_i, labels: {listener: $2}
when /\Astatistics: max connection count (\d+) for \((.+)\) at (.*)/
@anvil_max_connection_count.set $1.to_i, labels: {listener: $2}
when /\Astatistics: max cache size (\d+) at (.*)/
@anvil_max_cache_size.set $1.to_i
else
STDERR.puts "# #{entry._systemd_unit} #{entry.syslog_identifier}: #{entry.message}"
end
when 'policyd-spf'
case entry.message
when /\Aprepend Received-SPF: (\w+) /
@spf.increment labels: {status: $1.downcase}
when /\A[^ ]+ [^ ]+ Message rejected due to: SPF fail /
# postfix@-.service policyd-spf: 550 5.7.23 Message rejected due to: SPF fail - not authorized.
@spf_fail.increment
else
STDERR.puts "# #{entry._systemd_unit} #{entry.syslog_identifier}: #{entry.message}"
end
else
STDERR.puts "# #{entry._systemd_unit}: #{entry.syslog_identifier} #{entry.message}"
end
end
end