Re-Write grep command for Exim Mail Log

If this grep command pulls the count, e-mail username, and src IP from the EXIM log when using courier:

grep "A=courier_login" /var/log/exim_mainlog | sed -e 's#H=.* \[##' -e 's#\]:[0-9]*##' | awk '{print $5,$6}' | sort | uniq -c

example output:
      8 users.ip.add.ress

What would I change to get the same info from the log file that dovecot uses?

sample entry in dovecot log file:
Sep 22 04:03:00 CPanelHostname dovecot: pop3-login: Login: user=<>, method=PLAIN, rip=users.ip.add.ress, lip=mail.server.ip.address


Here are some note on what the grep statement is doing for the courier log file.

grep "A=courier_login" /var/log/exim_mainlog

Locate successful email logs in the Exim mail log. 

sed -e 's#H=.* \[##' -e 's#\]:[0-9]*##'

Use the sed -e command to first strip out the (UserComputer) [ section from the log, then follow with another -e flag to also take off the ]:1234 section surrounding the user's IP address. 

awk '{print $5,$6}'

Use the awk command to only print the $5th and $6th columns, which is the email address and IP address. 

sort | uniq | awk '{print $1}' | uniq -c

Sort all the data by the email addresses, then only show unique entries so you should get and for instance. Use awk to only print the $1st column which is the email address, then uniquely count them. 

awk '{ if ($1 > 1) print $0}'

Use the awk command with an if statement so that if the $1st column has a count higher than 1 it prints out the total line. This should show how many unique IP addresses a given email address has been accessed over. 

Open in new window

Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

grep 'pop3-login' | sed -e 's/.*user=\<//' -e 's/\>.*rip=/ /' -e 's/, lip.*$//' | sort | uniq -c

The above will count both successfull and failed attempts.  You can add to the grep Login:

Sed strips out unneeded pterns leaving only the username and IP, this is why awk is not needed.
jasgotAuthor Commented:
It's showing me the count, month, an src IP. Can you change the month to the user?
try the following.

the \> and \< meant to escape caused the pattern replacement match to not match.

grep 'pop3-login' | grep ': Login: user' | sed -e 's/.*user=<//' -e 's/>.*rip=/ /' -e 's/, lip.*$//' | sort | uniq -c

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
Determine the Perfect Price for Your IT Services

Do you wonder if your IT business is truly profitable or if you should raise your prices? Learn how to calculate your overhead burden with our free interactive tool and use it to determine the right price for your IT services. Download your free eBook now!

Note the sed allows you to pick several separator, my choice was / the one used in your script is # the reason for these changes deals with what your pattern consists of. if the pattern included a / in my case I would have had to escape it (\/) to avoid sed interpreting the / instead of a pattern but a terminating point for the prior separator (/)
the below pattern you want to replace the / with a space.
echo "username/password" | sed -e 's#/# #'
echo "username/password" | sed -e 's/\// /'
jasgotAuthor Commented:
That worked a treat! Thank you!
jasgotAuthor Commented:
Just had to add the path and name of the log file!
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Email Servers

From novice to tech pro — start learning today.