> ## Documentation Index
> Fetch the complete documentation index at: https://docs.abusix.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Setup of the Comparison Tool

> Step-by-step instructions for requesting, installing, and running the Guardian Mail Comparison Tool in logfile mode to evaluate DNSBL performance using your own mail logs.

## **Requesting the “Comparison Tool”**

To request the “Comparison Tool,” you must have an active trial of Guardian Mail. You may sign up for a trial at [https://abusix.com/contact-us/ ](https://abusix.com/contact-us/)

Once your trial is live, ask our support team for the comparison binary. They will need to know if you need a Linux, Mac, or Windows binary.

## **Installation**

Download the “Comparison Tool” and make it executable:

```
$ chmod +x ami_compare_linux
```

If run without any options – it will output its usage and available command line options:

```
$ ./ami_compare.linux
Usage: ami_compare.linux --apikey <apikey> --list <list> <filename>

Options:
  --version   Show version number                                [boolean]
  --apikey    Guardian Mail API key                   [required]
  --list          DNS suffix of the DNSBL to compare against     [required]
  --debug    Write debug output to stderr                        [boolean]
  --cache    Cache result data to reduce DNS load                [boolean]
  -h, --help  Show help                                          [boolean]

Copyright 2021, Abusix Inc.
Node v8.17.0 (x64)
Using DNS servers: 1.1.1.1

Not enough non-option arguments: got 0, need at least 1
```

## **Logfile Mode**

To use the tool in logfile mode, you must provide a file that contains a list of [IPs](https://abusix.com/glossary/intrusion-prevention-systems/) to be checked. This list should be extracted from your production system(s) log files. The logs should be no more than two days old and as recent as possible to achieve the best results. The list can either be a simple, de-duplicated list of [IP](https://abusix.com/glossary/internet-protocol-address/) addresses or a list that includes a count (e.g., occurrences) and [IP](https://abusix.com/glossary/internet-protocol-address/) addresses. The latter is preferred, as it will provide a more accurate result.

## **Data Preparation**

Here is an example of extracting a list of [IPs](https://abusix.com/glossary/intrusion-prevention-systems/) from a Postfix server using standard UNIX tools. This can be modified to work with most logfile formats with some minor modifications.

```
$ grep -Poh '\d+\.\d+\.\d+\.\d+' /var/log/mail.log | sort  | uniq -c | sort -rn > ips_to_test
```

This will create a file called “ips\_to\_test” that contains “\<count> \<ip>” pairs, where \<count> is the number of times each [IP](https://abusix.com/glossary/internet-protocol-address/) address has been seen in the logs. The file will be sorted such that the [IP](https://abusix.com/glossary/internet-protocol-address/) addresses with the largest number of occurrences appear first.