Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I want to parse my /var/log/maillog to print out the email addresses in from=<> and to=<> (mainly to do a quick check for false positives in the DNS RBLs that I've configured)

A maillog entry looks like this (postfix):

Jun 20 17:27:52 foobarserver postfix/smtpd[15925]: NOQUEUE: reject: RCPT from sbr.nouveauquebec.com[]: 554 5.7.1 Service unavailable; Sender address [corporate@nouveauquebec.com] blocked using urired.spameatingmonkey.net; Red listed, see http://spameatingmonkey.com/lookup/nouveauquebec.com; from=<something@spam.com> to=<foo@foo.bar> proto=ESMTP helo=<sbr.nouveauquebec.com>

and my regex is

from=<(\b[A-Z0-9._%+-]+@[A-Z0-9.-]+\.[A-Z]{2,4}\b)> to=<(\b[A-Z0-9._%+-]+@[A-Z0-9.-]+\.[A-Z]{2,4}\b)>

I'm storing the matches in back references \1 and \2 which I want to print out. What I want to do is pipe the output from cat /var/log/maillog and apply the regex on each line and output the backreferences.

Is there a quick way to accomplish this?

share|improve this question
up vote 1 down vote accepted

Using sed:

sed -r -n 's/^.* from=<([^>]+)>\s*to=<([^>]+)>.*$/\1 \2/p' /var/log/maillog
share|improve this answer

This one uses a simplified regex and non-greedy quantifiers:

perl -ne 's/^.*from=<(.+?@.+?)> to=<(.+?@.+?)>.*$/$1 $2/; print;' /var/log/maillog
share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.