in reply to Postfix maillog parser
#!/usr/bin/perl -w use strict; use Time::Local; if( @ARGV != 3 ) { print "Usage: $0 START END MESSAGE-ID|ADDRESS\n"; print "i.e. $0 \@20050426T000000 \@0426T08 videok4\@hosting.agava. +ru\n"; exit; } my ($start, $end, $m_id)=@ARGV; sub iso2epoch($) { my $str=shift; my ($mday, $mon, $year)=(localtime)[3,4,5]; $year+=1900; my ($hr, $min, $sec)=(0, 0, 0); if( $str =~ /^@(\d*)T(\d*)$/ ) { my ($date, $time)=($1, $2); if( $date =~ /^(\d{2,2})(\d{2,2})(\d{2,2})(\d{2,2})$/ ) { # all elements $year="$1$2"; $mon=$3-1; $mday=$4; } elsif ( $date =~ /^(\d{2,2})(\d{2,2})(\d{2,2})$/ ) { # 3 last elements $mon=$2-1; $mday=$3; my $year_2=$1; $year=~/^(\d{2,2})/; $ +year="$1$year_2"; } elsif ( $date =~ /^(\d{2,2})(\d{2,2})$/ ) { # 2 last elements $mon=$1-1; $mday=$2; } elsif ( $date =~ /^(\d{2,2})$/ ) { # 1 last element $mday=$1; } elsif ( $date eq "" ) { # none } else { # syntax error return undef; } if( $time =~ /^(\d{2,2})(\d{2,2})(\d{2,2})$/ ) { # hrs, min, sec $hr=$1; $min=$2; $sec=$3; } elsif ( $time =~ /^(\d{2,2})(\d{2,2})$/ ) { # hrs and min $hr=$1; $min=$2; } elsif ( $time =~ /^(\d{2,2})$/ ) { # hrs only $hr=$1; } elsif ( $time eq "" ) { # midnight } else { # syntax error return undef; } return timelocal($sec, $min, $hr, $mday, $mon, $year); } elsif ( $str eq "@" ) { # empty return timelocal(0, 0, 0, $mday, $mon, $year); } return undef; } my %mon2mm=qw/Jan 0 Feb 1 Mar 2 Apr 3 May 4 Jun 5 Jul 6 Aug 7 Sep 8 Oc +t 9 Nov 10 Dec 11/; my($month, $day, $time, $hr, $min, $sec, $msg_unixtime, $year); my($host, $proc, @msg, $msg, $qid); $year=(localtime)[5]+1900; $qid=""; $start=iso2epoch($start); $end=iso2epoch($end); if( !defined($start) ) { print "START: $ARGV[0] is not correct\n"; } if( !defined($end) ) { print "END: $ARGV[1] is not correct\n"; } if( !defined($start) || !defined($end) ) { exit; } print "Parsing maillog.log\n"; open(FILE, "<maillog.log") || die "Cannot open maillog.log: $!"; while( <FILE> ) { ($month, $day, $time, $host, $proc, @msg)=split; ($hr, $min, $sec)=split ':', $time; $msg_unixtime=timelocal($sec, $min, $hr, $day, $mon2mm{$month}, $y +ear); last if ( $msg_unixtime > $end ); next if ( $msg_unixtime < $start ); $msg=join ' ', @msg; if( $msg =~ /(message-id|from|to)=<(.*?)>/ ) { if( $2 eq $m_id ) { # message found if( $msg=~/^([A-F0-9]+): / ) { $qid=$1; last; } } } } if( $qid eq "" ) { print "No messages found\nDone\n"; exit; } print "QID found: $qid\n"; seek(FILE, 0, 0); while(<FILE>) { ($month, $day, $time, $host, $proc, @msg)=split; ($hr, $min, $sec)=split ':', $time; $msg_unixtime=timelocal($sec, $min, $hr, $day, $mon2mm{$month} +, $year); last if ( $msg_unixtime > $end ); next if ( $msg_unixtime < $start ); $msg=join ' ', @msg; if( $msg =~ /$qid/ ) { print; } } close(FILE); print "Done\n";
|
|---|
| Replies are listed 'Best First'. | |
|---|---|
|
Re^2: Postfix maillog parser
by Golo (Friar) on Apr 02, 2005 at 03:40 UTC | |
by nikos (Scribe) on Apr 02, 2005 at 09:48 UTC |