6/ You should probably define REGEX_EMAIL as '<[^@<>]*@[^@<>]*\.[^@<>]*>', I have that in my .bashrc b/c I need it in so many scripts, but you can always use the regex as is if you don't want to define it as a variable, so you'd have :
grep Relay /var/log/mail.log | sed 's/messagerie-prep amavis.*},//;s/\(Queue-ID\|Message-ID\).*, Hits/Hits/;s/Hits:\([^,]\+\).*/Hits:\1/ | grep --color=always '<[^@<>]*@[^@<>]*\.[^@<>]*>'$ 3/ This is host specific. My own hostname is 'messagerie-prep', you should change that to whatever your hostname is. Yassine. On Thursday, March 29, 2018, 1:17:03 PM GMT+1, Poliman - Serwis <ser...@poliman.pl> wrote: Thank you for explanation but in my case: root@s1:~# grep Relay /var/log/mail.log | sed 's/messagerie-prep amavis.*},//;s/\(Queue-ID\|Message-ID\).*, Hits/Hits/;s/Hits:\([^,]\+\).*/Hits:\1/ | grep --color=always $REGX_EMAIL > > ^C root@s1:~# echo $REGX_EMAIL root@s1:~# Should I have some additional file or should I add some parameter? 2018-03-29 12:57 GMT+02:00 chaouche yacine <yacinechaou...@yahoo.com>: Sorry there was a mistake in the line I gave you, maybe I have edited it before pasting. Here's a brief explanation along with a "light" version ( you can customize ) : grep Relay /var/log/mail.log | sed 's/messagerie-prep amavis.*},//;s/\(Queue-ID\| Message-ID\).*, Hits/Hits/;s/Hits:\([^,]\+\).* /Hits:\1/ 1. grep Relay /var/log/mail.log | 2. sed 3. 's/messagerie-prep amavis.*},//; 4. s/\(Queue-ID\|Message-ID\).*, Hits/Hits/; 5. s/Hits:\([^,]\+\).*/Hits:\1/ 6. grep --color=always "$REGX_EMAIL ->" 1. Finding the needle in the haystack. 2. instead of extracting text, we're going to suppress unwanted text. 3. let's get rid of the part that sits between the date and the sender 4. let's get rid of the part that sits between the last recipient and the spam score (Hits) 5. let's get rid of what's after the spam score 6. Finally, we can colorize our output with grep --color=always. The REGEX_EMAIL is : '<[^@<>]*@[^@<>]*\.[^@<>]*>'. This will make the e-mail addresses stand out for a better reading experience. See : https://i.imgur.com/xAwSPfz. png On Thursday, March 29, 2018, 6:52:17 AM GMT+1, Poliman - Serwis <ser...@poliman.pl> wrote: Probably you have right. What should be in part: @mydomain.tld|rpub@mydomain. tld' is it some mail to send notifications after pipe? 2018-03-29 7:47 GMT+02:00 Olivier <olivier.nic...@cs.ait.ac.th>: Poliman - Serwis <ser...@poliman.pl> writes: I think it should read: ...|egrep --line-buffered -v '(...)'|sed... with a closing parenthesis before the closing quote Olivier > [1:text/plain Show] > > > [2:text/html Hide Save:noname (20kB)] > > Wow, huge piece of linux commands. Currently too hard to modify for me. ;) > Now it returns (I also > try changed mydomain.tld to something real) > root@serwer1:~# tail -f /var/log/mail.log | egrep --line-buffered 'Relay' | > egrep --line-buffered -v ' > (Process_Control| notifications.systemes| PODCAST-|Admin-ch|PUB_CONTROL| > @mydomain.tld|rpub@mydomain. tld' > | sed -u 's/messagerie-prep amavis.*},//;s/Hits:\([^,]\+\) .*/HITS:\1/; > s/\(Queue-ID\|Message-ID\).*, > HITS/Hits/'|grep "$REGX_EMAIL ->" > grep: Unmatched ( or \( > > I use: > ps -eo user|sort|uniq -c|sort -n > ps -aux | grep {user} but these commands don't give me what I need in this > case. > > 2018-03-28 17:31 GMT+02:00 chaouche yacine <yacinechaou...@yahoo.com>: > > I use this line : > > tail -f /var/log/mail.log | egrep --line-buffered 'Relay' | egrep >--line-buffered -v ' > (Process_Control| notifications.systemes| PODCAST-|Admin-ch|PUB_CONTROL| >@mydomain.tld|rpub@mydomain. tld' > | sed -u 's/messagerie-prep amavis.*},//;s/Hits:\([^,]\+\) .*/HITS:\1/; s/\ > (Queue-ID\|Message-ID\).*, HITS/Hits/'|grep "$REGX_EMAIL ->" > > This will strip out automatic notifications and give me output like this : > > Mar 28 16:25:24 LOCAL [127.0.0.1]:47600 <wassila.bes...@mydomain.tld> -> > <a.gheba...@mydomain.tld>,<r. bena...@mydomain.tld>, Hits: -0.999 > > One can tee this into a file and build from there. You can do basic stuff >with the (sort | uniq -c > | sort -n) pipe machine. > > On Wednesday, March 28, 2018, 3:09:24 PM GMT+1, Poliman - Serwis ><ser...@poliman.pl> > wrote: > > Thank you, I will check it. I am looking for information which linux user >sends email and how > many, for example, per hour, day. That would be perfect plugin. > > 2018-03-28 15:59 GMT+02:00 Matus UHLAR - fantomas <uh...@fantomas.sk>: > > Poliman - Serwis: > > Hi people. Do you know is there any tool/plugin for monitoring outgoing > emails from server with postfix? Maybe postfix has this feature? > > On 28.03.18 09:57, Wietse Venema wrote: > > Postfix logs all transactions. I suggest that you look for tools > that analyze Postfix logs. > > pflogsumm, for example. available in most OS/distribution repositories and > at: http://jimsun.linxnet.com/post fix_contrib.html > > -- > Matus UHLAR - fantomas, uh...@fantomas.sk ; http://www.fantomas.sk/ > Warning: I wish NOT to receive e-mail advertising to this address. > Varovanie: na tuto adresu chcem NEDOSTAVAT akukolvek reklamnu postu. > M$ Win's are shit, do not use it ! > > -- > Pozdrawiam / Best Regards > Piotr Bracha -- -- Pozdrawiam / Best Regards Piotr Bracha -- Pozdrawiam / Best Regards Piotr Bracha