I wish I could do something like this in virtusertable:

jra54449 [at] cs.columbia.edu error:5.7.0:550 User unknown
$&{client_addr}

I could edit virtusertable.m4 to do it as below (this works). I'd
rather avoid editing a standard file though, for future
maintainability. Is there a way to get it into virtusertable?

R< error : $-.$-.$- : $+ > $* $#error $ [at] $1.$2.$3 $: $4
$&{client_addr}


The reason might be of interest. We (columbia.edu) host
cs.columbia.edu using virtusertable. A spammer is sending a huge
volume of mail with the sender address shown, to a very bad (or very
large?) recipient list. We are getting 1.4 million bounces a day to
this address, which does not and never did exist. We'd like to
identify the hosts hammering us with this stuff without having to
match the "User unknown" syslog line to the "from=" syslog line--
given the numbers involved.

Joseph Brennan
Columbia University IT

In article <1191427674.292749.48590 [at] 57g2000hsv.googlegroups.com> Joe
Brennan <brennan [at] columbia.edu> writes:
>
>I wish I could do something like this in virtusertable:
>
>jra54449 [at] cs.columbia.edu error:5.7.0:550 User unknown
>$&{client_addr}
>
>I could edit virtusertable.m4 to do it as below (this works). I'd
>rather avoid editing a standard file though, for future
>maintainability. Is there a way to get it into virtusertable?
>
>R< error : $-.$-.$- : $+ > $* $#error $ [at] $1.$2.$3 $: $4
>$&{client_addr}

No, but it's trivial to add as a custom rule in your .mc file (i.e. not
using virtusertable at all):

LOCAL_RULE_0
R jra54449< [at] cs.columbia.edu.> $#error $ [at] 5.7.0 $: "550 User unknown " $&{client_addr}

--Per Hedeland
per [at] hedeland.org

> No, but it's trivial to add as a custom rule in your .mc file (i.e. not
> using virtusertable at all):

But that's too simple :-) Thanks