I have a learning environment, based on Linux CentOS, with Postfix and SquirrelMail running, but my assignment is more in general.

I need to find in the maillog e-mails received by a certain user within a certain time frame, based only on his Linux username.

I see my maillog, but I am not experienced in reading maillog and I have two concerns:

  1. Whether or not these patterns that I see in the log are something reliable, i.e. whether a log for incoming e-mail will always have to=<EMAIL> in it.

    Jan 2 20:31:17 tmcent01 postfix/local[27450]: B58C4330038: to=<root@tmcent01.training5.tm>, orig_to=<postmaster>, relay=local, delay=9.7, delays=9.6/0.03/0/0.02, dsn=2.0.0, status=sent (delivered to mailbox)
  2. How does a Linux username correspond to the e-mail name of the user? It is not it always a match (username@domain), is it? We could have alias for it, how can I take this in consideration when composing the Regex for the grep?

My first two attempts were a strike-out.

sudo grep "to=<jsmith@" /var/log/maillog | grep 1[2-4]:[0-5][0-9]:[0-5][0-9]
sudo grep -w "jsmith" /var/log/maillog | grep 1[2-4]:[0-5][0-9]:[0-5][0-9]

Here's a simple sample script for you to try. It will search for user's aliases from the common /etc/aliases -file.

# Arguments: 
# $1 = user name to be searched for
# $2 = location for e-mail log file
# First, let's create a temporary working directory.
WORKDIR=$(mktemp -d)
# Create a file for user's user name and all aliases.
echo "to=<"$1 > search_key.txt
# Then, let's find out possible alises for the user.
# Awk is used just to separate the first column.
grep $1 /etc/aliases | awk 'BEGIN { FS=":" }; {print "to=<" $1}' >> search_key.txt
# Next, search for e-mails sent for all these.
grep -f search_key.txt $2
# Finally, remove the working directory.
rm -rf ${WORKDIR}
# All done.
  • Thank you for your answer, but this is a fixed assignment, it must be done with grep. – pmihova Jul 29 '15 at 10:19
  • If you can use only grep, then it is a bit difficult for you, in case you need to search for aliases also. But for the first question, just searching for "to=<username" should be sufficient, i.e. grep "to=<johndoe" /var/log/mail.log – Kalle Jul 29 '15 at 10:21
  • OP looks on the right track... and the pointer to the aliases looks a step in the right direction too.... I would suggest looking at the documentation about how aliases are defined and try greping the logfile with the output of grep -Po "[^:]*(?=:.*jsmith@.*)" \etc\aliases as well as the username.... – bu5hman Apr 13 at 16:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.