On Sat, Nov 30, 2024 at 13:03:32 +0000, Michael Kjörling wrote: > # awk '{ if($5 ~ "^postfix[[]") { print } }' </var/log/messages
That's a rather verbose way of writing that awk command. awk '$5 ~ "^postfix[[]"' /var/log/messages Also, I'm quite new to postfix, but this pattern doesn't appear to match any lines in my log files. First of all, the lines in question seem to be in /var/log/syslog on Debian 10, not in messages. Second, they all look like: Nov 30 08:43:08 remote postfix/smtpd[5243]: connect from bendel.debian.org[82.195.75.100] and so on, with postfix followed by a slash, not a square bracket. Maybe your system is different, and therefore your logs are different. This is actually an endorsement for the systemd journal, where the lines in question are identified precisely by the unit/service name, and don't need to be matched by a questionable regular expression.