0

I need to filter the mail-log to send reports to me everyday, so I can track blocked addresses easily.

This is part of the log:

Oct  2 14:22:49 mail postfix/smtp/smtpd[3401121]: NOQUEUE: reject: RCPT from cloud831541.educacaa.com.br[45.140.41.93]: 554 5.7.1 Service unavailable; Client host [45.140.41.93] blocked using dnsbl.sorbs.net; Currently Sending Spam See: http://www.sorbs.net/lookup.shtml?45.140.41.93; from=<[email protected]> to=<leonardo@home-server> proto=ESMTP helo=<cloud831541.educacaa.com.br>
Oct  2 14:26:02 mail postfix/smtp/smtpd[3403329]: NOQUEUE: reject: RCPT from ws21763.adcote.com.br[185.249.200.83]: 554 5.7.1 Service unavailable; Helo command [ws217632.adcote.com.br] blocked using dbl.spamhaus.org; https://www.spamhaus.org/query/domain/adcote.com.br; from=<[email protected]> to=<leonardo@home-server> proto=ESMTP helo=<ws217632.adcote.com.br>
Oct  2 14:43:51 mail postfix/smtp/smtpd[3403329]: NOQUEUE: reject: RCPT from o12.mailer.shopify.com[149.72.90.155]: 554 5.7.1 Service unavailable; Client host [149.72.90.155] blocked using spam.dnsbl.sorbs.net; Spam Received See: http://www.sorbs.net/lookup.shtml?149.72.90.155; from=<bounces+12398229-c901-leonardo=home-server.net.br@mailer.shopifyemail.com> to=<leonardo@home-server> proto=ESMTP helo=<o12.mailer.shopify.com>

I need to cut from RCPT from until : and before 554 5.7.1 and also print from blocked using until ; before Currently Sending.

So the output would be something like this =

RCPT from cloud831541.educacaa.com.br[45.140.41.93] -- blocked using dnsbl.sorbs.net

A way easier to check who was blocked by my mail filters.

I appreciate any help.

1 Answer 1

2

It seems as if the following long-ish sed substitution may do what you want.

sed -n 's/.*\(RCPT from[^:]*\):.*554 5\.7\.1.*\(blocked using[^;]*\);.*Currently Sending.*/\1 -- \2/p' file

It is doing what you said by capturing the two bits of the lines you wanted using \(...\) twice. We're mainly using various static strings to anchor the regular expression to the line, and if any bit does not match, sed will not output the line. The expressions [^:]* and [^;]* will match any (possibly empty) substring that does not contain a : or ;, respectively, and .* matches any substring whatsoever.

If all of the expression matches we replace the whole line using the two collected substrings and a double dash, and we output the modified line.

The result, given the data in the question, will be a single line.

RCPT from cloud831541.educacaa.com.br[45.140.41.93] -- blocked using dnsbl.sorbs.net
4
  • It worked perfectly. Thank you so much! Oct 4, 2021 at 12:18
  • Could I add the date/time of the grep log? Eg.: Oct 2 14:43:51 -- RCPT from ... Oct 6, 2021 at 15:29
  • @LeonardoL.Southier We're not using grep. To capture the first part of the line, before mail: sed -n 's/^\(.*\) mail.*\(RCPT from[^:]*\):.*554 5\.7\.1.*\(blocked using[^;]*\);.*Currently Sending.*/\1 -- \2 -- \3/p' file I'm sure you can see how this is done now and can do further refinements by yourself.
    – Kusalananda
    Oct 6, 2021 at 16:56
  • Yes, I see now. Sorry for changing commands, when I wrote grep I mean sed haha. Your command works just fine, thank you. Oct 6, 2021 at 21:12

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .