Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

I want to parse my /var/log/maillog to print out the email addresses in "from=<>" and "to=<>" (mainly to do a quick check for false positives in the DNS RBLs that I've configured)

A maillog entry looks like this (postfix):

Jun 20 17:27:52 foobarserver postfix/smtpd[15925]: NOQUEUE: reject: RCPT from sbr.nouveauquebec.com[184.22.154.110]: 554 5.7.1 Service unavailable; Sender address [corporate@nouveauquebec.com] blocked using urired.spameatingmonkey.net; Red listed, see http://spameatingmonkey.com/lookup/nouveauquebec.com; from=<something@spam.com> to=<foo@foo.bar> proto=ESMTP helo=<sbr.nouveauquebec.com>

and my regex is

from=<(\b[A-Z0-9._%+-]+@[A-Z0-9.-]+\.[A-Z]{2,4}\b)> to=<(\b[A-Z0-9._%+-]+@[A-Z0-9.-]+\.[A-Z]{2,4}\b)>

I'm storing the matches in back references \1 and \2 which I want to print out. What I want to do is pipe the output from cat /var/log/maillog and apply the regex on each line and output the backreferences.

Is there a quick way to accomplish this?

share|improve this question
add comment

2 Answers 2

up vote 1 down vote accepted

Using sed:

sed -r -n 's/^.* from=<([^>]+)>\s*to=<([^>]+)>.*$/\1 \2/p' /var/log/maillog
share|improve this answer
add comment

This one uses a simplified regex and non-greedy quantifiers:

perl -ne 's/^.*from=<(.+?@.+?)> to=<(.+?@.+?)>.*$/$1 $2/; print;' /var/log/maillog
share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.