Want to go through exim logs for past 24 hours and sum up total number of emails on per user basis, please suggest me command(s)

I know how to view emails currently in queue.. but I want to find which users have sent most number of emails in past 24 hours.


It might depend on how your logging is setup, but I think this would work on a default system:

grep -oP "A=\K([A-Za-z0-9_.:]+)" /var/log/exim4/mainlog | sort | uniq -c | sort -nr

Which would output something like this:

151 dovecot_plain:grafana
 12 dovecot_plain:jolt
  6 dovecot_plain:banana
  2 dovecot_login:banana

What I do here is to find A= which contains the username and how they were authenticated from /var/log/exim4/mainlog, then I pipe it to sort and uniq -c, which aggregates them as a group and gives you a number. The last sort -nr just gives me the count in an ordered group in reverse (max number first).

If you have different types of authentication, let's say dovecot_plain and dovecot_login but with the same username, then the easiest way to get rid of that is to put in another grep that only get what is after ":", like so:

grep -oP "A=\K([A-Za-z0-9_.:]+)" /var/log/exim4/mainlog | grep -oP ":\K(.*)" | sort | uniq -c | sort -nr

And the output:

151 grafana
 12 jolt
  8 banana

Note: I have not take in account the 24h limit, since that also depends on how logging is setup, and it gets more complicated and I think this is a good start. Otherwise you need to somehow filter your log timestamps with grep to ilter the dates, then pipe that to my grep string.

  • 1
    If the last 24h is important enough, then add this before the other grep: sed -n '/2018-11-01 14/,/2018-11-02 14/p' /var/log/exim4/mainlog and set the dates to match your liking and log format. – Fredrik Nov 2 '18 at 14:05
  • ty Fredrik.. that worked. Server uses dovcot_login btw. 2 problems though, 1st I wanted user@domain, which I figured out, thx to your regex. 2nd I want the dates & hrs to be dynamic, by that I mean date should match 'yesterday today' format, so I don't have to change date every time I run command. 2nd the hour should match the hour when the command is entered. – Sollosa Nov 3 '18 at 8:38
  • Also, does output only include the local sender IDs? – Sollosa Nov 3 '18 at 9:13
  • The reason I used username was that a person can have multiple identities etc, so that forfilled your question. If you want more information, like whom they are mailing, then the stats would be harder to calculate, and then you probably don't want to do that as a oneliner in bash, but perhaps use python or some other language that you are comfortable with, and I don't have tlme to write that. – Fredrik Nov 4 '18 at 16:08
  • thank you Fredrik, you already guided me to the right path, I can't thank you enough. – Sollosa Nov 6 '18 at 10:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.