I was looking for some advice and examples on searching mail log effectively

Suppose situation is like this

-------- Forwarded Message --------
Subject: Fwd: Re: Notice of Allowance 
Date: Fri, 13 Mar 2015 16:02:17 +0530
From: Sachin Tendulkar <[email protected]>
To: Brett lee <[email protected]>
CC: 'Brian Lara' <[email protected]>

Now Problem is mail not received by recipient so I have to find out what's wrong and I can do that by grepping.

What I did is grep "from=<[email protected]>" /var/log/mail.log then again grepped the queue ids.

My question is: what would be most effective syntax to search for the exact mail or narrow down the search result as the command I used returned 83 results!

PS: Any link to some good materials on Searching Logs will also be very helpful.

  • What do you mean by "search for the exact mail"? - If the recipient complains that the mail did not arrive, search for mails matching ^To: .*<recipient-address>. And if the sender complains, search for mails matching ^From: .*<sender-address>.
    – Janis
    Mar 17, 2015 at 16:33
  • @janis, Thanks for your prompt reply. I exactly did that and the again grepped the queue id in the mail log but in between 16:00 to 16:15 83 mails has been sent so I was wondering is there any way to search option can be more precise. since the mail had 3 recipients so was it possible to narrow down the search somehow?
    – Neel
    Mar 17, 2015 at 17:23
  • Really wondering whats the negative vote for? Is it a fashion here? Or only masters with huge rep can ask questions?
    – Neel
    Mar 17, 2015 at 17:35
  • I'm wondering myself as well. The reason may be that your question is not formulated clear enough. Though personally I don't think it's worth a downvote. IMO, a comment is more appropriate to give the poster a chance to edit his question.
    – Janis
    Mar 17, 2015 at 17:39
  • WRT your question in the other comment; it's still not clear enough what exactly you want. Maybe you can extend your question appropriately and supported by samples. Comment fields are not well suited for descriptions or non-trivial clarifications of the actual question.
    – Janis
    Mar 17, 2015 at 17:41

1 Answer 1


You can use the idea from this thread on SF: Need help grepping postfix log.

First you should search all possible queue IDS matching your criteria. To do that you can use command

grep 'from=<[email protected]>' /var/log/maillog | cut -d ' ' -f 6


grep 'to=<[email protected]' /var/log/maillog | cut -d ' ' -f 6

Then you can use queue ID from the log to list all information based on queue ID

grep 'to=<[email protected]>' /var/log/maillog | cut -d ' ' -f 6 | grep -f - /var/log/maillog

Of course that will list all entry, if you need grep nrcpt=3 then pipe them.

grep 'to=<[email protected]' /var/log/maillog | cut -d ' ' -f 6 | grep -f - /var/log/maillog | grep nrcpt=3

Additional note:

The above email above only list address in email header. But, postfix only logs the envelope address.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .