4

I'm trying to search for an unknown string (Message ID) in a log based on a known string (recipient address), and then grep the unknown string to output the entire relevant log information. I'm able to use grep and cut to output the unknown string(s), but from there I'm stumped on passing that to grep. I've used a pipe to xargs grep and that is not producing the output I'm looking for. Here is the command I'm using to grep and cut:

grep 'to=<emailaddress' /var/log/maillog | cut -d ' ' -f 6

This produces output of all the unknown strings for messages processed by Postfix for emailaddress. When I pipe to xargs I receive "grep: : No such file or directory:

grep 'to=<emailaddress' /var/log/maillog | cut -d ' ' -f 6 | xargs grep /var/log/maillog

Thanks for your help.

3
  • I'm a bit lost at the moment. What do you want? A list of the message IDs of the mails sent to a special recipient?
    – Mario Lenz
    Aug 25, 2014 at 19:51
  • The grep utility can read the patterns to match from a file with the -f switch. You can also use - as the filename for -f so it will read stdin from the pipe. No need for xargs.
    – user9517
    Aug 25, 2014 at 19:56
  • I am searching for all Message IDs where the pattern is 'to=<emailaddress', and then output all log information regarding each Message ID. Since I do not know what the Message ID is, nor any other relevant information other than the e-mail address, I needed to be able to find all Message IDs and output the relevant log information for each. Thanks Iain. That did the trick: grep 'to=<emailaddress' /var/log/maillog | cut -d ' ' -f 6 | grep -f - /var/log/maillog.
    – uxphreak
    Aug 25, 2014 at 20:03

2 Answers 2

5

I've been playing around a bit with my own mail logs. Try

grep 'to=<emailaddress' /var/log/maillog | cut -d ' ' -f 6 | grep -f - /var/log/maillog

The -f - will read the list of strings to search for from stdin.

1

I wrote a perl script which allows you to grep any information from log that you want and it will print all lines with the same queue id (with one pass thru the file and without file size limitation):

https://github.com/brablc/postfix-tools/blob/master/pflogrep

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .