We have a mail user on our postfix server that was using the company mail to send compromising information to the competence.
I've been asked to make a report of the actions for that user in the last time.
There are tools like pflogsumm and others that can extract statistic data, but I haven't so far find anything useful to get all the info for a user.
I'd like to get something like this:
For the sent mail
11/11/11 00:00:00 infractor@example.com -> user@anothercompany.com
11/11/11 00:00:01 infractor@example.com -> user2@anothercompany2.com
For the received mail
10/10/11 00:00:00 user@anothercompany.com -> infractor@example.com
10/10/11 00:00:01 user2@anothercompany2.com -> infractor@example.com
I know I can do a script by myself, but matching the postfix ID for every mail is not something that can be made with a simple grep, and I've a lot of mail history that I have to recheck distributed among diferent files and so on.
