I am using fetchmail in combination with procmail for mail filtering on CentOS where my mail contains various log messages. They serve me so I could search through my mail(logs) for error strings. So does anyone haves an idea how could I check if one mail is missing because I have a fixed number of mail sent to me every day, and if a server crashes obviously it won't send the mail, how can I determine if a mail is missing and if it is to send an alert through email?

When I get my mail with fetchmail and process it with procmail I need to look through procmail.log file so I could determine if a certain mail hasn't arrived. My log file looks like this:

From root1@example1.com  Wed Dec 31 10:38:49 2014
 Subject: example1 -> Incremental 1 -> DEV backup
  Folder: /dev/null                                                      235603
From root2@example2.yu  Wed Dec 31 10:38:50 2014
 Subject: example2
  Folder: /dev/null                                                        5983
From root3@example3.yu  Wed Dec 31 10:38:50 2014
 Subject: example3 -> Full Offline Backup DEV
  Folder: /dev/null                                                       40978
From xenbackup@example4.rs  Wed Dec 31 10:38:50 2014
 Subject: [OK] [ example4]
  Folder: /dev/null

So these mails are received during a day, and they must be there at a certain time when I need to check if every mail has arrived (exists in the log file). Now I need a way to see if each of these mails are present in the log. And it can be searched just by the from line.

2 Answers 2


You can run a periodic log analyzer of some sort to verify that you have received everything you expect to receive. Perhaps something like this.

awk 'BEGIN {
      split(e, expected, /:/) }
  /^From / { seen[$2]++ }
  END { for (x in expected) if (!(expected[x] in seen)) print expected[x] " missing" }
  ' Mail/procmail.log

Make sure you have a log from the period of time you want to check (last 24 hours?) and pass it to this script. If one of the "expected" records is missing, it will alert.

The script simply looks for the second field of each From log line and extracts it into seen. At the end, if there are records in expected which are not in seen, issue an alert message for each.

You could run this out of your crontab to have an email delivered to you if the script generates any output. It would make sense to run this in conjuction with a log rotation script so that you archive and process your latest log file (at least roughly) at the same time. Then you don't need to parse time stamps in the log file, etc; anything which is in this log file is for the period you are interested in.

  • Sry for the delayed response was overwhelmed with work... Thanks this for the answer, this is somewhat i was aiming for. I want to put all of the mail to a mailbox after filtering them through procmail, then i need to write a script that would maybe through egrep search for the maching senders in the mailbox, and if some is missing to send an email message to my alert mailbox, after that empty the mailbox. Maybe sounds complicated but in plain just a script that would search for certain strings in mailbox and empty it afterwards. Tnx
    – dusan90
    Dec 30, 2014 at 11:56
  • 1
    That's feasible too, but processing the log file seems simpler if it contains all the information you need to decide whether you have received what you should. In case it's not obvious, I assumed you would be examining procmail.log but the code could certainly be adapted to other scenarios.
    – tripleee
    Dec 30, 2014 at 12:22
  • Ok, i am starting too see where were you going with this, and you are right it's far simpler to do it through log file. i will edit the question so i would clear up the situation.
    – dusan90
    Dec 31, 2014 at 10:41
  • Updated answer to adjust to the new details from your edit.
    – tripleee
    Dec 31, 2014 at 11:43
  • Nailed it in the head :) tripleee tnx for everything, this works like a magic even if i don't understand awk much, and in combination with crontab it will be a great asset on my monitor server for backup logs. Great thanks again :)
    – dusan90
    Jan 5, 2015 at 10:36

Checkout www.smtpviewer.com. Send a copy of the e-mail you are expecting to this site and it will warn you if it is not received for a specific period.Lets say 24 hours if you are expecting an e-mail every 24 hours. It also can warn you if specific keywords are contained inside the subject or body of e-mails.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.