Mailgraph

[Tenaka]

I guess you all know by now that I love graphs :)

I found a new tool: http://people.ee.ethz.ch/~dws/software/mailgraph/
its called mailgraph and is supposed to display mail statistics like sent/received/rejected/spam/virus and bounced...

unfortunately it will not really show spam for me and it shows a little bit too few of my virus mails ;-(

first of all it is set to monitor the syslog file but I changed that to the /var/log/mail.log.ispconfigsave which seemed a better idea to me - right?

I added one line to catch viruses is this ok?
elsif($prog eq 'TrashScan') {
if($text =~ /Suspicious/) {
event($time, 'virus');
}
}


are there other lines indicating virus?

the standard line to find infected mails is this but it does not work for me:
elsif($prog eq 'spamd') {
if($text =~ /^(?:spamd: )?identified spam/) {
event($time, 'spam');
}
}


any other idea on how to identify spam?


###edit###
Or maybe you know another tool to display this kind of information graphically?

[Tenaka]

no one has got any ideas? any other soft that can do this?

[ecorona]

I set it up, but no spam/virus graph at all.

[Tenaka]

anyone got an update on this? I am using the perfect debian 3.1 setup

no graphs show up at all,.... while I followed this tutorial: http://www.howtoforge.com/mail_statistics_mailgraph_pflogsumm

although I must admit I had a manually installed version of rrdtool, but right now I also installed the apt-get version and still no graphs to be seen here: http://www.web-designerz.de/cgi-bin/mailgraph.cgi

also the pflogsumm has this entry:
Sender address rejected: Domain not found (total: 2)
2 pw-auth@02.ebay.com


which seems to be a legitimate email from ebay - does it not?
on the other hand it seems its a forgery, sorry for misusing this post
Sep 10 01:08:44 h898552 postfix/smtpd[11574]: connect from fmmailgate03.web.de[217.72.192.234]
Sep 10 01:08:44 h898552 postfix/smtpd[11574]: NOQUEUE: reject: RCPT from fmmailgate03.web.de[217.72.192.234]: 450 <pw-auth@02.ebay.com>: Sender address rejec
ted: Domain not found; from=<pw-auth@02.ebay.com> to=<postmaster@web-designerz.de> proto=ESMTP helo=<fmmailgate03.web.de>
Sep 10 01:08:44 h898552 postfix/smtpd[11574]: disconnect from fmmailgate03.web.de[217.72.192.234]


in case you want to help I have some more hints:

www.web-designerz.de||||1215||||62.159.242.114 - - [12/Sep/2006:08:36:43 +0200] "GET /cgi-bin/mailgraph.cgi?0-e HTTP/1.1" 500 1215 "http://www.web-designerz.de/cgi-bin/mailgraph.cgi" "Mozilla/5.0 (Windows; U; Windows NT 5.1; de; rv:1.8.0.6) Gecko/20060728 Firefox/1.5.0.6"


it seems like an 500 server error but I can see the basic page, just not the graphs...
Ok this is solved too: the mailgraph was trying to store its images here: /var/lib/mailgraph/,cgi-bin meaning inside /var/lib/mailgraph which was by default owned by www-data:www-data so I had to change to the user the suexec of that virtualhost was running :-)
no I am just wondering why the directory looks this strange: /var/lib/mailgraph/,cgi-bin?? well does not matter, but what about this:

I thought I could just download the newest version 1.12 and replace the 3 files of which mailgraph consists with the newer version as debian stable is using version 1.10 but if I do this I do not see any graphs, no idea why as the directories and the owners and groups stay the same...

any chance to get SA and clamav to make logs that could be used to count spam and viruses instead of having to somehow implement amavis?

[falko]

any chance to get SA and clamav to make logs that could be used to count spam and viruses instead of having to somehow implement amavis?
I don't know if that's possible... :(

[Tenaka]

I found severall issues:

a) saying spamd is faster and better than spamassassin: http://mail-archives.apache.org/mod_mbox/spamassassin-users/200607.mbox/%3C44B3B4CA.3010607@comcast.net%3E

b) Mail::SpamAssassin::Logger http://www.annocpan.org/~FELICITY/Mail-SpamAssassin-3.1.5/lib/Mail/SpamAssassin/Logger.pm can you look at those links? there is also a Mail::SpamAssassin::Logger::File http://www.annocpan.org/~FELICITY/Mail-SpamAssassin-3.1.5/lib/Mail/SpamAssassin/Logger/File.pm and a Mail::SpamAssassin::Logger::Syslog http://www.annocpan.org/~FELICITY/Mail-SpamAssassin-3.1.5/lib/Mail/SpamAssassin/Logger/Syslog.pm

I do not have any clue how to use b) and I do not know much about a)...

maybe someone interested too can get me going...

[till]

a) saying spamd is faster and better than spamassassin: http://mail-archives.apache.org/mod_mbox/spamassassin-users/200607.mbox/%3C44B3B4CA.3010607@comcast.net%3E

Spamd is faster, but we can not simply switch from spamassassin to spamd as the spamc command that is used to send the messages to spamd does not support the commandline switch for specifying the spamassassin configuartion file that ISPConfig uses. There is a workaround for that by symlinking the spamassassin config files in every users directory but I we will have to test that in the dev branch if it is reliable.

[Tenaka]

ok thx for explaining, but how about those SA "modules" I linked above? I am not sure how these modules are to be used.. but they seem to be doing what we need: bring logging to spamassassin

[till]

ok thx for explaining, but how about those SA "modules" I linked above? I am not sure how these modules are to be used.. but they seem to be doing what we need: bring logging to spamassassin

I've never tested one of them, but I see no reason why they should not work if you load them in the spamassassin configuration uder /home/admispconfig/ispconfig/tools/spamassassin

[Tenaka]

hi,

I'll try out Mail::SpamAssassin::Logger::Syslog that seems the most appropiate one to use but can you give me some hints about where to put?

h898552:/home/admispconfig/ispconfig/tools/spamassassin/etc/mail/spamassassin# ls -al
total 24
drwxr-xr-x 2 admispconfig admispconfig 4096 Jul 19 07:37 .
drwxr-xr-x 3 admispconfig admispconfig 4096 May 22 22:20 ..
-rwxr-xr-x 1 admispconfig admispconfig 890 Aug 9 12:41 init.pre
-rwxr-xr-x 1 admispconfig admispconfig 789 Aug 9 12:41 local.cf
-rwxr-xr-x 1 admispconfig admispconfig 2395 Aug 9 12:41 v310.pre
-rwxr-xr-x 1 admispconfig admispconfig 806 Aug 9 12:41 v312.pre

[falko]

When you search in /home/admispconfig/ispconfig/tools/spamassassin, you should find a directory with .pm (Perl modules) files in it. Put it into that directory.

[edge]

I'll try out Mail::SpamAssassin::Logger::Syslog that seems the most appropiate one to use but can you give me some hints about where to put?
Is it not a simple perl -MCPAN -e shell and than an install Mail::SpamAssassin::Logger::Syslog

(I've done it on a virtula Debain OS, and it installed fine as far as I can see "/usr/bin/make install -- OK")

I do also see "spamd" in the mail log files, but as it's a virtual system, and as I do not have a working mailserver setup on it I can not test the rest!

[Hans]

I found severall issues:

a) saying spamd is faster and better than spamassassin: http://mail-archives.apache.org/mod_mbox/spamassassin-users/200607.mbox/%3C44B3B4CA.3010607@comcast.net%3E

I am very happy with Spamassassin, read my motivation here:
http://www.howtoforge.com/forums/showthread.php?t=6075&highlight=SPAMD

[Tenaka]

what I did was use the cpan method and loaded this:

# trying to get spamassassin to log to mail.log
loadplugin Mail::SpamAssassin::Logger::Syslog


into the init.pre file but I see no spam log trace anywhere... neither inside mail.* neither inside syslog....

[Tenaka]

anyone able to help with this?

[Tenaka]

anyone please? there must be someone who knows how to use this module... :-(

[todvard]

Here is an easy way how to configure mailgraph with ISPConfig.
The main problem with ISPConfig's spam and virus detection system is that nor clamassassin neither spamassassin log to syslog, so mailgraph won't know anything about found spams and viruses. We will use procmail and logger to send entries to syslog files (logger is a part of bsdutils package on debian based distributions, which means it is probably already installed).

First, install mailgraph:
apt-get install mailgraph
(or use your distributions default package installer)
(If you installing it from source be sure that you start it with "--ignore-localhost" option.)

Start the daemon:
/etc/init.d/mailgraph start

Copy mailgraph.cgi to a cgi-bin directory of an ISPConfig configured website which has CGI enabled. Check mailgraph in a browser. If it is working keep reading, if not, go back and doublecheck everything.

Configure spam detection:
add the following lines to a user's .spamassassin.rc file:

:0 c
* ^X-Spam-Status: Yes
| logger -p mail.info -t spamd spamd: identified spam
Add it after the line starting with "| /home/admispconfig/ispconf...", don't forget to put an empty line between them.

Configure virus detection:
add the following lines to a user's .antivirus.rc file:

:0:
* ^X-Virus-Status: Yes
{
:0 c
| logger -p mail.info -t smtp-vilter clamd: found virus

:0
/dev/null
}

Add it after the line starting with "| /home/admispconfig/ispconf...", don't forget to put an empty line between them.

Now you have a user, with whom you can test mailgraph. Use his/her email address to test spam and virus detection:
mail -s spamtest user@domain.com
XJS*C4JDBQADN1.NSBN3*2IDNEN*GTUBE-STANDARD-ANTI-UBE-TEST-EMAIL*C.34X
.

Check /var/log/mail.log. You should see a new entry, something like that:
Mar 7 12:20:27 isp spamd: spamd: identified spam

Check mailgraph in the browser. In few minutes you should see that number of found spam is increasing.

Test virus detection too, send an EICAR anti-virus test message to the same user. (you can download test files form here (http://www.eicar.org/anti_virus_test_file.htm). Don't be afraid, it's not a virus, just a test!).
Check /var/log/mail.log again. You should see a new entry, something like that:
Mar 7 11:37:46 isp smtp-vilter: clamd: found virus

Check mailgraph in the browser. In few minutes you should see that number of found viruses is increasing.

If everything is working fine you can enable configurations server-wide. Do the same changes in /root/ispconfig/isp/conf/antivirus.rc.master and /root/ispconfig/isp/conf/spamassassin.rc.master files (or use the included patch files) Keep a copy from original files, just in case... A user's config file will be updated when you change any setting on that user in ISPConfig. (or you can use this link (http://www.howtoforge.com/forums/showpost.php?p=34481&postcount=2) to see how to update them in one step.)

Hope it helps.
T.

[Tenaka]

I woudl like to try this but I am having more serious problems:

here is the url: http://www.web-designerz.de/cgi-bin/mailgraph.cgi
this is web1, the suexec entry in the vhost looks like: SuexecUserGroup web1_postmaster web1 and this entry is inside my vhost entry too: ScriptAlias /cgi-bin/ /var/www/web1/cgi-bin/


this is the output of a ls -al:

:/var/www/web1/cgi-bin# ls -al ../cgi-bin/
total 16
drwxrwxr-- 2 web1_postmaster web1 4096 Sep 12 08:58 .
drwxr-xr-x 20 web1_postmaster web1 4096 Feb 18 15:41 ..
-rwxrwxr-- 1 web1_postmaster web1 0 Feb 28 2006 .csc
-r-------- 1 web1_postmaster web1 0 Feb 28 2006 .no_delete
-rwxr-xr-x 1 web1_postmaster web1 7009 Nov 27 2004 mailgraph.cgi


so why do I get 403 errors?

here is the error log of the site: [Thu Mar 08 13:05:15 2007] [crit] [client 62.159.242.114] (13)Permission denied: /var/www/web1/cgi-bin/.htaccess pcfg_openfile: unable to check htaccess file
, ensure it is readable


why is it trying to read a .htaccess file inside cgi-bin? even saving an empty .htaccess into cgi-bin did not solve anything...

[martinfst]

Any rewrite rule that might be playing tricks on you? Looks oke to me so far....:confused:

[Tenaka]

I do have an .htaccess inside /var/www/web1/web and as the scriptalias redirects from /var/www/web1/web/cgi-bin to: /var/www/web1/cgi-bin the .htaccess from there might be making problems:


# BEGIN WordPress
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteBase /
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . /index.php [L]
</IfModule>

# END WordPress


I have wordpress installed inside this web - can you help?

[martinfst]

- can you help?I can try ....
.htaccess rules are 'promoted' to sub-directories. E.g. Apache traverses the whole tree to look for .htaccess files and if found processes them. What happens (with you mailstats) if you rename/remove ..../web1/web/.htaccess? Just for testing

[Tenaka]

its definitely not that .htaccess - I renamed to .htaccess.bckp and the problem persists, even the same error in the log file...

[martinfst]

I have no ideas at the moment :confused:

[todvard]

how is your apache vhost entry looks like for that host? do you have cgi module installed in apache? can you check the mailgraph.cgi in another host where wordpress isn't installed?

[falko]

It seems to be a permissions problem:
http://cephas.net/blog/2005/06/17/awstats-installation-notes/
http://cc.uoregon.edu/cnews/backissues/webserver_upgrade.html
http://archive.apache.org/gnats/2747
http://lists.trustix.org/pipermail/tsl-discuss/2004-July/011507.html

But from what I see everything looks fine. Maybe one of the parent directories has too strict permissions?

[Tenaka]

I just checked it in another vhost, here is the error log:

[Sat Mar 10 07:59:08 2007] [error] [client 86.122.61.77] ERROR: opening '/var/lib/mailgraph/mailgraph.rrd': No such file or directory, referer: http://www.kissaki.de/cgi-bin/mailgraph.cgi
[Sat Mar 10 07:59:08 2007] [error] [client 86.122.61.77] client denied by server configuration: /var/www/web4/cgi-bin/mailgraph.cgi, referer: http://www.kissaki.de/cgi-bin/mailgraph.cgi
[Sat Mar 10 07:59:08 2007] [error] [client 86.122.61.77] Premature end of script headers: mailgraph.cgi, referer: http://www.kissaki.de/cgi-bin/mailgraph.cgi
[Sat Mar 10 07:59:08 2007] [error] [client 86.122.61.77] client denied by server configuration: /var/www/web4/cgi-bin/mailgraph.cgi, referer: http://www.kissaki.de/cgi-bin/mailgraph.cgi


And indeed this directory does not exist: /var/lib/mailgraph/ ?

The vhost for the first vhost where I checked:

# Vhost: www.web-designerz.de:80
######################################
#
#
<VirtualHost 85.214.51.208:80>
<Directory /var/www/web1/web/ispcstats>
Options ExecCGI -Indexes
AllowOverride None
AllowOverride Indexes AuthConfig Limit FileInfo
Order allow,deny
Allow from all
<Files ~ '^.ht'>
Deny from all
</Files>
</Directory>
SuexecUserGroup web1_postmaster web1
ServerName www.web-designerz.de:80
ServerAdmin webmaster@web-designerz.de
DocumentRoot /var/www/web1/web
ServerAlias web-designerz.de
DirectoryIndex index.html index.htm index.php index.php5 index.php4 index.php3 index.shtml index.cgi index.pl index.jsp Default.htm default.htm
ScriptAlias /cgi-bin/ /var/www/web1/cgi-bin/
AddHandler cgi-script .cgi
AddHandler cgi-script .pl
ErrorLog /var/www/web1/log/error.log
AddType application/x-httpd-php .php .php3 .php4 .php5
php_admin_flag safe_mode Off
AddType text/html .shtml
AddOutputFilter INCLUDES .shtml
AddType application/vnd.wap.wmlscriptc .wmlsc .wsc
AddType text/vnd.wap.wml .wml
AddType text/vnd.wap.wmlscript .ws .wmlscript
AddType image/vnd.wap.wbmp .wbmp
Alias /error/ "/var/www/web1/web/error/"
ErrorDocument 400 /error/invalidSyntax.html
ErrorDocument 401 /error/authorizationRequired.html
ErrorDocument 403 /error/forbidden.html
ErrorDocument 404 /error/fileNotFound.html
ErrorDocument 405 /error/methodNotAllowed.html
ErrorDocument 500 /error/internalServerError.html
ErrorDocument 503 /error/overloaded.html
AliasMatch ^/~([^/]+)(/(.*))? /var/www/web1/user/$1/web/$3
AliasMatch ^/users/([^/]+)(/(.*))? /var/www/web1/user/$1/web/$3
</VirtualHost>


enabled apach2 modules:
ls /etc/apache2/mods-enabled/
cache.load fcgid.load perl.load ssl.conf
cgi.load include.load php4.conf ssl.load
dosevasive.conf mem_cache.conf php4.load suexec.load
dosevasive.load mem_cache.load proxy.conf userdir.conf
fastcgi.conf mod-security.conf proxy.load userdir.load
fastcgi.load mod-security.load proxy_http.load
fcgid.conf perl.conf rewrite.load


###edit###
got it to also show no longer errors fro mthe first vhost, I simply kept trying all chmods and chowns... but still it says:

[Sat Mar 10 08:07:25 2007] [error] [client 86.122.61.77] client denied by server configuration: /var/www/web1/cgi-bin/mailgraph.cgi, referer: http://www.web-designerz.de/cgi-bin/mailgraph.cgi
[Sat Mar 10 08:07:25 2007] [error] [client 86.122.61.77] ERROR: opening '/var/lib/mailgraph/mailgraph.rrd': No such file or directory, referer: http://www.web-designerz.de/cgi-bin/mailgraph.cgi
[Sat Mar 10 08:07:25 2007] [error] [client 86.122.61.77] Premature end of script headers: mailgraph.cgi, referer: http://www.web-designerz.de/cgi-bin/mailgraph.cgi
[Sat Mar 10 08:07:25 2007] [error] [client 86.122.61.77] client denied by server configuration: /var/www/web1/cgi-bin/mailgraph.cgi, referer: http://www.web-designerz.de/cgi-bin/mailgraph.cgi

[todvard]

I just checked it in another vhost, here is the error log:
And indeed this directory does not exist: /var/lib/mailgraph/ ?
...

this directory should exist. It seems that you haven't configured mailgraph properly yet. create this directory, then try to start the mailgraph daemon, check for errors. if there is no errors at start mailgrap populate /var/lib/mailgraph directory with .rrd files soon.

your configuration files seems fine to me.

[Tenaka]

thx.

it was indeed my configuration file, it seems that while installing, reinstalling etc. I messed them up.

Its working now, you can have a peek here (http://www.web-designerz.de/cgi-bin/mailgraph.cgi), but still no spam and virus mails being logged :-(

here are the remaining errors from my logfile:

[Tue Mar 13 01:15:51 2007] [error] [client 86.122.61.77] client denied by server configuration: /var/www/web1/cgi-bin/mailgraph.cgi, referer: http://www.web-designerz.de/cgi-bin/mailgraph.cgi


###edit###
h898552:/var/www/web1# ls -al cgi-bin/
total 16
drwxr-xr-x 2 web1_postmaster web1 4096 Mar 8 13:26 .
drwxr-xr-x 20 web1_postmaster web1 4096 Feb 18 15:41 ..
-rwxr-xr-x 1 web1_postmaster web1 0 Feb 28 2006 .csc
-rwxr-xr-x 1 web1_postmaster web1 0 Feb 28 2006 .no_delete
-rwxr-xr-x 1 web1_postmaster web1 7009 Mar 10 07:56 mailgraph.cgi

so the perms are right ...

and yes I see the spam and virus entries inside the /var/log/mail.log file, but it seems mailgraph is not picking them up. I restarted mailgraph still no luck. any more changes needed?

###edit2###
also my mailgraph.cgi has a line like this:

my $rrd_virus = '/var/lib/mailgraph/mailgraph_virus.rrd';

doens't it need a similar line to know where spam lies?

###edit3###
helped myself a bit, as I found out mailgraph.pl seems to not include the right "string" to catch spamd messages from the mail.log so I tried modifying these lines inside mailgraph.pl

elsif($prog eq 'spamd') {
if($text =~ /^spamd: identified spam/) {
event($time, 'spam');
}
}

I inserted the red code above.
Also had to insert this code to catch viruses:
elsif($prog eq 'smtp-vilter') {
if($text =~ /^clamd: found virus/) {
event($time, 'virus');
}
}

[todvard]

what is in your /var/log/mail.log file? how is the log entries looks like? what is in the mailgraph config file? have you configured properly your antivirus.rc and spamassassin.rc files to log properly to syslog? I didnt had to edit mailgraph.pl file, i could do all needed configurations inside in these two .rc files.

[Tenaka]

here is how the mail.log file looks like:

h898552:/var/lib/mailgraph# cat /var/log/mail.log | grep virus
Mar 13 09:33:41 h898552 smtp-vilter: clamd: found virus
Mar 13 09:33:42 h898552 smtp-vilter: clamd: found virus
Mar 13 09:33:50 h898552 smtp-vilter: clamd: found virus
Mar 13 09:33:50 h898552 smtp-vilter: clamd: found virus
Mar 13 09:39:40 h898552 smtp-vilter: clamd: found virus
Mar 13 09:39:41 h898552 smtp-vilter: clamd: found virus
Mar 13 09:39:48 h898552 smtp-vilter: clamd: found virus

h898552:/var/lib/mailgraph# cat /var/log/mail.log | grep spam | more
Mar 13 06:37:45 h898552 spamd: spamd: identified spam
Mar 13 06:42:11 h898552 spamd: spamd: identified spam
Mar 13 06:55:10 h898552 spamd: spamd: identified spam
Mar 13 06:55:10 h898552 spamd: spamd: identified spam
Mar 13 06:58:20 h898552 spamd: spamd: identified spam


so all works like you described BUT mailgraph does not know how these log entries look like. The definitions it looks for are inside mailgraph.pl you have to do the changes I quoted above although I am a bit unsure about the one concerning viruses as it does not show any viruses until now... but spam works fine now.

###edit###
VIRUSes started appearing in my graphs too :-) although I have beens sending myself EICAR viruses the whole day ;-)

[Tenaka]

in the meantime I am back to having no graphs show up.

can we get back to the roots? I am so tired of trying this to run :-(
what should I check first?

see it here in action: http://www.web-designerz.de/cgi-bin/mailgraph.cgi

h898552:/var/log# tail -f /var/www/web1/log/error.log
[Thu Oct 18 13:30:16 2007] [error] [client 82.77.200.145] ERROR: Opening '/var/lib/mailgraph/,cgi-bin/mailgraph_1_err.png' for write: No such file or directory, referer: http://www.web-designerz.de/cgi-bin/mailgraph.cgi
[Thu Oct 18 13:30:16 2007] [error] [client 82.77.200.145] Premature end of script headers: mailgraph.cgi, referer: http://www.web-designerz.de/cgi-bin/mailgraph.cgi
[Thu Oct 18 13:30:16 2007] [error] [client 82.77.200.145] ERROR: Opening '/var/lib/mailgraph/,cgi-bin/mailgraph_2.png' for write: No such file or directory, referer: http://www.web-designerz.de/cgi-bin/mailgraph.cgi
[Thu Oct 18 13:30:16 2007] [error] [client 82.77.200.145] Premature end of script headers: mailgraph.cgi, referer: http://www.web-designerz.de/cgi-bin/mailgraph.cgi
[Thu Oct 18 13:30:16 2007] [error] [client 82.77.200.145] ERROR: Opening '/var/lib/mailgraph/,cgi-bin/mailgraph_2_err.png' for write: No such file or directory, referer: http://www.web-designerz.de/cgi-bin/mailgraph.cgi
[Thu Oct 18 13:30:16 2007] [error] [client 82.77.200.145] Premature end of script headers: mailgraph.cgi, referer: http://www.web-designerz.de/cgi-bin/mailgraph.cgi
[Thu Oct 18 13:30:17 2007] [error] [client 82.77.200.145] ERROR: Opening '/var/lib/mailgraph/,cgi-bin/mailgraph_3.png' for write: No such file or directory, referer: http://www.web-designerz.de/cgi-bin/mailgraph.cgi
[Thu Oct 18 13:30:17 2007] [error] [client 82.77.200.145] Premature end of script headers: mailgraph.cgi, referer: http://www.web-designerz.de/cgi-bin/mailgraph.cgi
[Thu Oct 18 13:30:17 2007] [error] [client 82.77.200.145] ERROR: Opening '/var/lib/mailgraph/,cgi-bin/mailgraph_3_err.png' for write: No such file or directory, referer: http://www.web-designerz.de/cgi-bin/mailgraph.cgi

[Tenaka]

ok, found the error: the tempfolder was not correct: I changed this line inside my mailgraph.cgi:

my $tmp_dir = '/tmp/mailgraph';

and chmodded that folder to 777 => it seems mailgraph.cgi was not allowed to write inside the original fodler.