Revisiting an old subject.
The option in the exim/virtual/limit is nice, but it really only logs the number... after the predefined threshold.
Once the limit file has a number greater than 0, the exim.pl will start to count the number of emails sent by a user. In the /etc/virtual/usage directory, there will be 2 types of files. 'username' and 'username.bytes'. The bytes file will store how large each email was. The total sum of the bytes in that files will give the amount of outgoing smtp bandwidth used that day (this is always enabled). The other file ('username') is used to count the number of emails sent. Each email sent will add another byte to the file, so the exact size of the file is the number of emails sent.
When looking for a spammer, check the /etc/virtual/usage/username files to see a larger file, and also check /etc/virtual/usage/username.bytes, to look for a repeated size. Large number of same-sized emails generally indicates spam.
Exim can handle rate limiting via ACL's directly, but when I attempt to add any actual limiter it's spewing:
Starting exim: 2006-09-27 08:44:17 Exim configuration error in line 374 of /etc/exim.conf:
error in ACL: unknown ACL condition/modifier in "ratelimit = 300 / 1h / per_rcpt / strict"
According to a google search, these ACL rules should be valid - but as noted above in the error, they're not working.
Anyone successfully using ratelimit in their exim.conf ? I'd sure appreciate seeing your default configurations.
# Log all senders' rates
warn
ratelimit = 0 / 1h / strict
log_message = \
Sender rate $sender_rate > $sender_rate_limit / $sender_rate_period
# Slow down fast senders
warn
ratelimit = 100 / 1h / per_rcpt / strict
delay = ${eval: 10 * ($sender_rate - $sender_rate_limit) }
# Keep authenticated users under control
deny
ratelimit = 100 / 1d / strict / $authenticated_id
# System-wide rate limit
defer
message = Sorry, too busy. Try again later.
ratelimit = 10 / 1s / $primary_hostname
Thanks!
Joe