Monitoring mail server with zabbix?

[ferran]

Hi all,

I'm Ferran, i'm new in the forum however I have been using zabbix for a year. I have a couple of questions.

I would like to monitor a mail server, to ensure that our email accounts are not being hacked or used to spam.

The mail server is running under pararllels plesk.

I have been looking for this information in google and in the zabbix documentation, but i don't find anything.

Please if someone knows if is this possible let me know it, I would appreciate your help a lot.

Thanks in advance.

Ferran.

[aib]

First question which you have to ask from Mail server administrator: Do you have any tools to understand that your mail account hacked?

Or in different words: Which metric you would like to monitor? Amount of messages in queues? Increasing of amount of users? Size of messages?

When you completely understand which numbers will give you the full picture, you can start to work about configuring the information collection and creating of triggers.

[ferran]

Hi aib,

I would like to monitor the amount of messages in queue.
If we have more than X messages in queue means that we got a hacked account.
We are using qmail.

I am really lost...

Thanks.

[aib]

Let's start from some articles.

How do I View Messages in the Qmail Queue?

Can't find qmail-qstat

qmail-qstat service installation

When you type qmail-qstat and get a result that says something like:

5 total in queue:
3 of these are pre-processed and scheduled for delivery
2 of these are not pre-processed

Then you can add UserParameter= line to /etc/zabbix/zabbix_agent.conf on the server where you have qmail installed.

UserParameter=queuedepth,qmail-qstat | grep "total in" | awk '{print $$1;}'

And, after restarting the agent, you can create an Item on Zabbix Server in Host which describe your mail server.

Name: Depth of mail queue
Type: Zabbix agent
key: queuedepth
Type of information: Numeric(unsigned)
Data type: Decimal
.....

Then you can create a graph to draw a chart for Mail queue.

It is more clear now?

[ferran]

Thanks a lot aib!

That was really helpfull, I will test it tomorrow morning.

Thanks again for all the information.