Extract data from EXIM log
I have log in following format
2018-11-11 06:02:32 1gLkhU-002yf9-3G <= email@domain.com H=(netserver.br - 2.15.2.2 -) [127.0.0.1]:48270 P=esmtpsa X=TLSv1.2:ECDHE-RSA-AES256-GCM-SHA384:256 CV=no A=dovecot_plain:my@dom.com S=3209 T="test" for my@gmail.com
I need to extract from the row example above only this and exactly in this format
email@domain.com my@dom.com
note: the dovecot_plain: sometime could be only a username (not a full email)
I am using this
grep "dovecot_plain:" /var/log/exim_mainlog | egrep -a -E -io " [A-Z0-9._%+-]+@[A-Z0-9.-]+.[A-Z]2,4 | A=dovecot_plain:[A-Z0-9.@_%+-]1,100"
but it's not working as I need, because it's returning this
email@domain.com
A=dovecot_plain:my@dom.com
in two separate rows ...
Any idea how to extract exactly in this format ?
email@domain.com my@dom.com
p.s. also I need to extract this data only for latest 6 hours in EXIM log, do you think it's possible ?
Thank you
file logging sed grep exim
asked Nov 13 '18 at 17:14
gr68gr68
1451214
add a comment |
I have log in following format
2018-11-11 06:02:32 1gLkhU-002yf9-3G <= email@domain.com H=(netserver.br - 2.15.2.2 -) [127.0.0.1]:48270 P=esmtpsa X=TLSv1.2:ECDHE-RSA-AES256-GCM-SHA384:256 CV=no A=dovecot_plain:my@dom.com S=3209 T="test" for my@gmail.com
I need to extract from the row example above only this and exactly in this format
email@domain.com my@dom.com
note: the dovecot_plain: sometime could be only a username (not a full email)
I am using this
grep "dovecot_plain:" /var/log/exim_mainlog | egrep -a -E -io " [A-Z0-9._%+-]+@[A-Z0-9.-]+.[A-Z]2,4 | A=dovecot_plain:[A-Z0-9.@_%+-]1,100"
but it's not working as I need, because it's returning this
email@domain.com
A=dovecot_plain:my@dom.com
in two separate rows ...
Any idea how to extract exactly in this format ?
email@domain.com my@dom.com
p.s. also I need to extract this data only for latest 6 hours in EXIM log, do you think it's possible ?
Thank you
file logging sed grep exim
asked Nov 13 '18 at 17:14
gr68gr68
1451214
add a comment |
I have log in following format
2018-11-11 06:02:32 1gLkhU-002yf9-3G <= email@domain.com H=(netserver.br - 2.15.2.2 -) [127.0.0.1]:48270 P=esmtpsa X=TLSv1.2:ECDHE-RSA-AES256-GCM-SHA384:256 CV=no A=dovecot_plain:my@dom.com S=3209 T="test" for my@gmail.com
I need to extract from the row example above only this and exactly in this format
email@domain.com my@dom.com
note: the dovecot_plain: sometime could be only a username (not a full email)
I am using this
grep "dovecot_plain:" /var/log/exim_mainlog | egrep -a -E -io " [A-Z0-9._%+-]+@[A-Z0-9.-]+.[A-Z]2,4 | A=dovecot_plain:[A-Z0-9.@_%+-]1,100"
but it's not working as I need, because it's returning this
email@domain.com
A=dovecot_plain:my@dom.com
in two separate rows ...
Any idea how to extract exactly in this format ?
email@domain.com my@dom.com
p.s. also I need to extract this data only for latest 6 hours in EXIM log, do you think it's possible ?
Thank you
file logging sed grep exim
asked Nov 13 '18 at 17:14
gr68gr68
1451214
I have log in following format
2018-11-11 06:02:32 1gLkhU-002yf9-3G <= email@domain.com H=(netserver.br - 2.15.2.2 -) [127.0.0.1]:48270 P=esmtpsa X=TLSv1.2:ECDHE-RSA-AES256-GCM-SHA384:256 CV=no A=dovecot_plain:my@dom.com S=3209 T="test" for my@gmail.com
I need to extract from the row example above only this and exactly in this format
email@domain.com my@dom.com
note: the dovecot_plain: sometime could be only a username (not a full email)
I am using this
grep "dovecot_plain:" /var/log/exim_mainlog | egrep -a -E -io " [A-Z0-9._%+-]+@[A-Z0-9.-]+.[A-Z]2,4 | A=dovecot_plain:[A-Z0-9.@_%+-]1,100"
but it's not working as I need, because it's returning this
email@domain.com
A=dovecot_plain:my@dom.com
in two separate rows ...
Any idea how to extract exactly in this format ?
email@domain.com my@dom.com
p.s. also I need to extract this data only for latest 6 hours in EXIM log, do you think it's possible ?
Thank you
file logging sed grep exim
file logging sed grep exim
asked Nov 13 '18 at 17:14
gr68gr68
1451214
asked Nov 13 '18 at 17:14
gr68gr68
1451214
asked Nov 13 '18 at 17:14
gr68gr68
1451214
asked Nov 13 '18 at 17:14
gr68gr68
1451214
asked Nov 13 '18 at 17:14
gr68gr68
1451214
1451214
add a comment |
add a comment |
1 Answer
1
active
oldest
votes
awk to the rescue
grep "dovecot_plain:" /var/log/exim_mainlog | awk 'BEGINmin_timestamp=systime() - 6*60*60datetime=$1 " " $2; gsub(/-timestamp>=min_timestampsplit($14,s,":"); print $5, s[2]'
Returns
email@domain.com my@dom.com
Only if log time >= systime - 6 hours
Edit
Pure awk solution as suggested by @tripleee
awk 'BEGINmin_timestamp=systime() - 6*60*60/dovecot_plain:/datetime=$1 " " $2; gsub(/-' /var/log/exim_mainlog
answered Nov 14 '18 at 10:21
Corentin LimierCorentin Limier
2,054159
2
Remember that anything that looks likegrep 'x' | awk ' y 'can be better writtenawk '/x/ y '; see also useless use ofgrep
– tripleee
Nov 14 '18 at 11:01
1
Edited thank you @tripleee
– Corentin Limier
Nov 14 '18 at 11:09
add a comment |
Your Answer
StackExchange.ifUsing("editor", function ()
StackExchange.using("externalEditor", function ()
StackExchange.using("snippets", function ()
StackExchange.snippets.init();
);
);
, "code-snippets");
StackExchange.ready(function()
var channelOptions =
tags: "".split(" "),
id: "1"
;
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function()
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled)
StackExchange.using("snippets", function()
createEditor();
);
else
createEditor();
);
function createEditor()
StackExchange.prepareEditor(
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: true,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: 10,
bindNavPrevention: true,
postfix: "",
imageUploader:
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
,
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
);
);
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f53286324%2fextract-data-from-exim-log%23new-answer', 'question_page');
);
Post as a guest
Required, but never shown
1 Answer
1
active
oldest
votes
1 Answer
1
active
oldest
votes
active
oldest
votes
active
oldest
votes
awk to the rescue
grep "dovecot_plain:" /var/log/exim_mainlog | awk 'BEGINmin_timestamp=systime() - 6*60*60datetime=$1 " " $2; gsub(/-timestamp>=min_timestampsplit($14,s,":"); print $5, s[2]'
Returns
email@domain.com my@dom.com
Only if log time >= systime - 6 hours
Edit
Pure awk solution as suggested by @tripleee
awk 'BEGINmin_timestamp=systime() - 6*60*60/dovecot_plain:/datetime=$1 " " $2; gsub(/-' /var/log/exim_mainlog
answered Nov 14 '18 at 10:21
Corentin LimierCorentin Limier
2,054159
2
Remember that anything that looks likegrep 'x' | awk ' y 'can be better writtenawk '/x/ y '; see also useless use ofgrep
– tripleee
Nov 14 '18 at 11:01
1
Edited thank you @tripleee
– Corentin Limier
Nov 14 '18 at 11:09
add a comment |
awk to the rescue
grep "dovecot_plain:" /var/log/exim_mainlog | awk 'BEGINmin_timestamp=systime() - 6*60*60datetime=$1 " " $2; gsub(/-timestamp>=min_timestampsplit($14,s,":"); print $5, s[2]'
Returns
email@domain.com my@dom.com
Only if log time >= systime - 6 hours
Edit
Pure awk solution as suggested by @tripleee
awk 'BEGINmin_timestamp=systime() - 6*60*60/dovecot_plain:/datetime=$1 " " $2; gsub(/-' /var/log/exim_mainlog
answered Nov 14 '18 at 10:21
Corentin LimierCorentin Limier
2,054159
2
Remember that anything that looks likegrep 'x' | awk ' y 'can be better writtenawk '/x/ y '; see also useless use ofgrep
– tripleee
Nov 14 '18 at 11:01
1
Edited thank you @tripleee
– Corentin Limier
Nov 14 '18 at 11:09
add a comment |
awk to the rescue
grep "dovecot_plain:" /var/log/exim_mainlog | awk 'BEGINmin_timestamp=systime() - 6*60*60datetime=$1 " " $2; gsub(/-timestamp>=min_timestampsplit($14,s,":"); print $5, s[2]'
Returns
email@domain.com my@dom.com
Only if log time >= systime - 6 hours
Edit
Pure awk solution as suggested by @tripleee
awk 'BEGINmin_timestamp=systime() - 6*60*60/dovecot_plain:/datetime=$1 " " $2; gsub(/-' /var/log/exim_mainlog
answered Nov 14 '18 at 10:21
Corentin LimierCorentin Limier
2,054159
awk to the rescue
grep "dovecot_plain:" /var/log/exim_mainlog | awk 'BEGINmin_timestamp=systime() - 6*60*60datetime=$1 " " $2; gsub(/-timestamp>=min_timestampsplit($14,s,":"); print $5, s[2]'
Returns
email@domain.com my@dom.com
Only if log time >= systime - 6 hours
Edit
Pure awk solution as suggested by @tripleee
awk 'BEGINmin_timestamp=systime() - 6*60*60/dovecot_plain:/datetime=$1 " " $2; gsub(/-' /var/log/exim_mainlog
answered Nov 14 '18 at 10:21
Corentin LimierCorentin Limier
2,054159
edited Nov 14 '18 at 11:09
answered Nov 14 '18 at 10:21
Corentin LimierCorentin Limier
2,054159
answered Nov 14 '18 at 10:21
Corentin LimierCorentin Limier
2,054159
answered Nov 14 '18 at 10:21
Corentin LimierCorentin Limier
2,054159
2,054159
2
Remember that anything that looks likegrep 'x' | awk ' y 'can be better writtenawk '/x/ y '; see also useless use ofgrep
– tripleee
Nov 14 '18 at 11:01
1
Edited thank you @tripleee
– Corentin Limier
Nov 14 '18 at 11:09
add a comment |
2
Remember that anything that looks likegrep 'x' | awk ' y 'can be better writtenawk '/x/ y '; see also useless use ofgrep
– tripleee
Nov 14 '18 at 11:01
1
Edited thank you @tripleee
– Corentin Limier
Nov 14 '18 at 11:09
2
2
Remember that anything that looks like
grep 'x' | awk ' y ' can be better written awk '/x/ y '; see also useless use of grep– tripleee
Nov 14 '18 at 11:01
Remember that anything that looks like
grep 'x' | awk ' y ' can be better written awk '/x/ y '; see also useless use of grep– tripleee
Nov 14 '18 at 11:01
1
1
Edited thank you @tripleee
– Corentin Limier
Nov 14 '18 at 11:09
Edited thank you @tripleee
– Corentin Limier
Nov 14 '18 at 11:09
add a comment |
Thanks for contributing an answer to Stack Overflow!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f53286324%2fextract-data-from-exim-log%23new-answer', 'question_page');
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
