From 497e2d738aa7bd384bf5e7057b73953c5fbb8338 Mon Sep 17 00:00:00 2001
From: Fredrik Wahlberg <fredrik@wahlberg.se>
Date: Fri, 20 Mar 2026 22:08:03 +0100
Subject: [PATCH] Nya regler efter pyspf-milter

---
 logcheck-fw-spam | 7 ++++++-
 testlog          | 3 +++
 2 files changed, 9 insertions(+), 1 deletion(-)

diff --git a/logcheck-fw-spam b/logcheck-fw-spam
index bf4f8c9..03386e6 100644
--- a/logcheck-fw-spam
+++ b/logcheck-fw-spam
@@ -89,4 +89,9 @@
 
 #Feb  3 06:44:29 nada runuser: pam_unix(runuser:session): session opened for user debian-spamd(uid=119) by (uid=0)
 #Feb  3 06:44:29 nada runuser: pam_unix(runuser:session): session closed for user debian-spamd
-^\w{3} [ :0-9]{11} [._[:alnum:]-]+ runuser: pam_unix\(runuser:session\): session (closed|opened) for user debian-spamd
\ No newline at end of file
+^\w{3} [ :0-9]{11} [._[:alnum:]-]+ runuser: pam_unix\(runuser:session\): session (closed|opened) for user debian-spamd
+
+#Mar 20 18:03:13 nada pyspf-milter[30540]: connect from aws-45.mta.apsis1.com at ('185.64.73.45', 54529) EXTERNAL
+#Mar 20 18:06:37 nada pyspf-milter[30540]: connect from s1-b441.socketlabs.email-od.com at ('142.0.180.65', 49374) EXTERNAL
+#Mar 20 18:08:44 nada pyspf-milter[30540]: connect from [111.26.95.254] at ('111.26.95.254', 44678) EXTERNAL
+\w{3} [ :0-9]{11} [._[:alnum:]-]+ pyspf-milter\[[0-9]+\]: connect from
\ No newline at end of file
diff --git a/testlog b/testlog
index 8573d61..002077d 100644
--- a/testlog
+++ b/testlog
@@ -792,6 +792,9 @@ Mar 31 20:28:36 nada sshd[21092]: Disconnected from invalid user  212.70.149.150
 Jan 22 00:01:04 nada nscd: 271 den övervakade filen ”/etc/resolv.conf” var moved into place, lägger till vakt
 Jan 22 00:09:11 nada named[5354]: validating ns2.ninjashost.net.br/A: got insecure response; parent indicates it should be secure
 Jun  8 01:01:04 nada nscd: 28428 den övervakade filen ”/etc/resolv.conf” var moved into place, lägger till vakt
+Mar 20 18:03:13 nada pyspf-milter[30540]: connect from aws-45.mta.apsis1.com at ('185.64.73.45', 54529) EXTERNAL
+Mar 20 18:06:37 nada pyspf-milter[30540]: connect from s1-b441.socketlabs.email-od.com at ('142.0.180.65', 49374) EXTERNAL
+Mar 20 18:08:44 nada pyspf-milter[30540]: connect from [111.26.95.254] at ('111.26.95.254', 44678) EXTERNAL
 
 
 Aug 23 18:39:24 nada fredrik[1713]: Kontrollrad. Syns detta har vi problem...