• Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 1017
  • Last Modified:

Re-Write grep command for Exim Mail Log

If this grep command pulls the count, e-mail username, and src IP from the EXIM log when using courier:

grep "A=courier_login" /var/log/exim_mainlog | sed -e 's#H=.* \[##' -e 's#\]:[0-9]*##' | awk '{print $5,$6}' | sort | uniq -c

example output:
      8 akastrati@domain.com users.ip.add.ress

What would I change to get the same info from the log file that dovecot uses?

sample entry in dovecot log file:
Sep 22 04:03:00 CPanelHostname dovecot: pop3-login: Login: user=<ileads@domain.com>, method=PLAIN, rip=users.ip.add.ress, lip=mail.server.ip.address


Here are some note on what the grep statement is doing for the courier log file.

grep "A=courier_login" /var/log/exim_mainlog

Locate successful email logs in the Exim mail log. 

sed -e 's#H=.* \[##' -e 's#\]:[0-9]*##'

Use the sed -e command to first strip out the H=example.com (UserComputer) [ section from the log, then follow with another -e flag to also take off the ]:1234 section surrounding the user's IP address. 

awk '{print $5,$6}'

Use the awk command to only print the $5th and $6th columns, which is the email address and IP address. 

sort | uniq | awk '{print $1}' | uniq -c

Sort all the data by the email addresses, then only show unique entries so you should get user@example.com and user@example.com for instance. Use awk to only print the $1st column which is the email address, then uniquely count them. 

awk '{ if ($1 > 1) print $0}'

Use the awk command with an if statement so that if the $1st column has a count higher than 1 it prints out the total line. This should show how many unique IP addresses a given email address has been accessed over. 

Open in new window

  • 3
  • 3
1 Solution
grep 'pop3-login' | sed -e 's/.*user=\<//' -e 's/\>.*rip=/ /' -e 's/, lip.*$//' | sort | uniq -c

The above will count both successfull and failed attempts.  You can add to the grep Login:

Sed strips out unneeded pterns leaving only the username and IP, this is why awk is not needed.
jasgotAuthor Commented:
It's showing me the count, month, an src IP. Can you change the month to the user?
try the following.

the \> and \< meant to escape caused the pattern replacement match to not match.

grep 'pop3-login' | grep ': Login: user' | sed -e 's/.*user=<//' -e 's/>.*rip=/ /' -e 's/, lip.*$//' | sort | uniq -c
Build your data science skills into a career

Are you ready to take your data science career to the next step, or break into data science? With Springboard’s Data Science Career Track, you’ll master data science topics, have personalized career guidance, weekly calls with a data science expert, and a job guarantee.

Note the sed allows you to pick several separator, my choice was / the one used in your script is # the reason for these changes deals with what your pattern consists of. if the pattern included a / in my case I would have had to escape it (\/) to avoid sed interpreting the / instead of a pattern but a terminating point for the prior separator (/)
the below pattern you want to replace the / with a space.
echo "username/password" | sed -e 's#/# #'
echo "username/password" | sed -e 's/\// /'
jasgotAuthor Commented:
That worked a treat! Thank you!
jasgotAuthor Commented:
Just had to add the path and name of the log file!
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

Join & Write a Comment

Featured Post

Keep up with what's happening at Experts Exchange!

Sign up to receive Decoded, a new monthly digest with product updates, feature release info, continuing education opportunities, and more.

  • 3
  • 3
Tackle projects and never again get stuck behind a technical roadblock.
Join Now