How do you deal with FreeBSD's periodic reports?

Question

Out of the box, every FreeBSD machine sends two e-mails per day to the administrator (root -- usually aliased to someone):

• Daily cron output (with status of disks, network interfaces, etc.)
• Daily security output (with penetration-attempts found in logs, etc.)

There are also weekly and monthly report-pairs, with outputs of the jobs deemed "heavier" (like locate-updates), which do not require daily runs.

Most of the time these e-mails are tedious to the extreme and I often find myself deleting them without reading. But I feel guilty doing it -- because one day I'm liable to miss something important and because, if I'm not reading it, I may as well redirect them into /dev/унітаз to begin with.

With 5-7 FreeBSD boxes (of my own and immediate family) under my care, this is getting bothersome -- is there, perhaps, some sort of software, that can alert me to potentially "interesting" reports while quietly stashing the rest away? Something "trainable" -- like a Bayesian spam-filter?

Ideally, it would integrate with Seamonkey/Thunderbird, but can also be command-line based (I'll run it from inside ~/.procmailrc)...

Answer 1

Regular expressions in procmail can span multiple lines (but, as with everything in procmail, you need to be careful lest a typo cause your rule to fail silently). In the past, I've written procmail recipes that match a report when everything goes well, and saves them to the noise mailbox. Then, if that report lands in my mailbox, it means that there's a problem I need to look at (either that, or that I have a problem with my .procmailrc)

Here's an example that looks at both the header and body of the message, and examines a complex report I used to receive at an old orkplace:

:0 :
* ^From: [email protected]
* ^To: [email protected]
* ^Subject: cron output from host.my.dom.ain
* B ?? ^^No account processing to do this run\.\.\.\
^Configuring databases\.  Please wait\.\.\.\
(^\*\*\* No IP address for.*)*\
^Processed [0-9]+ total hosts with the following distribution:\
(^[0-9]+        (common|osX|win(7|8)))+
\
^Generated [0-9]+ ganglia clusters containing [0-9]+ machines\
(^Installing new ssh_known_hosts\.\.\.)?\
^Looking for sendmail aliases to generate\
(^No users in passwd file that have no \(valid\) entry in aliases\.forward)?\
(^()\
^Updating the serial number in .*\.Zone )*\
(^Updating hosts file)?)+
noise

When you're writing your recipe, I recommend that you use a test message file and a test procmail file. Have the recipe save the message to a test file, then run procmail manually. Check the logging output to make sure that all of the conditions match. For the body-match part, try writing that one line at a time.