Find all messages that

• originate from specified servers. eg. "exch01/exch02/exch03/..."
• are sent to a specific domain or set of domains. eg ".gov.au" recipients
• are successfully delivered to the destination hosts ie. "status=sent"
• output the line that contains the above status report

Undesirable:

• messages orginating from any other server than those specified
• messages destined for any domain(s) other than the one(s) specified
• messages that are destined for our own domain, which is a subset of the ".gov.au" group - our domains are ourcorpdomain.com and ourdomain.gov.au
• a successful delivery status to localhost (this is the virus checker)

Notes:

• message ids are like the following: AAAF220809D. As a message is accepted by postfix, and then accepted again by the virus scanner, it will have two separate message ids on its journey to the destination
• the line that contains "relay=localhost" will also contain both message ids associated with a specific message
• The originating mail server shows up as "client=<server>".
• being able to give the "from" address would be a "nice to have" (but wasn't needed initially)

In the sample below, the message identified as 7763220809D|7A98C20809E is one that fulfils the requirements given.

Jun  7 15:44:46 gw3 postfix/qmgr[22316]: AAAF220809D: from=<m@mail.atu
+g.org.au>, size=114013, nrcpt=1 (queue active)
Jun  7 15:44:46 gw3 postfix/smtpd[31899]: EBBF220809B: client=localhos
+t.localdomain[127.0.0.1]
Jun  7 15:44:46 gw3 postfix/smtpd[32134]: disconnect from austra1778.l
+nk.telstra.net[165.228.245.121]
Jun  7 15:44:47 gw3 postfix/cleanup[31159]: EBBF220809B: message-id=<8
+A00D9112060F14CA34EBB00B8E4715C012CB31A@atug2k.ATUG.local>
Jun  7 15:44:47 gw3 postfix/qmgr[22316]: EBBF220809B: from=<m@mail.atu
+g.org.au>, size=114518, nrcpt=1 (queue active)
Jun  7 15:44:47 gw3 postfix/smtp[31898]: AAAF220809D: to=<r@ourcorpdom
+ain.com>, relay=localhost[127.0.0.1], delay=2, status=sent (250 Ok: q
+ueued as EBBF220809B)
Jun  7 15:44:47 gw3 postfix/qmgr[22316]: AAAF220809D: removed
Jun  7 15:44:47 gw3 postfix/smtpd[32026]: connect from exch01.windomai
+n.ourdomain.gov.au[172.16.10.173]
Jun  7 15:44:47 gw3 postfix/smtpd[32026]: 7763220809D: client=exch01.w
+indomain.ourdomain.gov.au[172.16.10.173]
Jun  7 15:44:47 gw3 postfix/cleanup[32301]: 7763220809D: message-id=<5
+6D3D9B855E3D94287CD8C8460B9999C030F1EFF@exch01.windomain.ourdomain.go
+v.au>Jun  7 15:44:47 gw3 postfix/qmgr[22316]: 7763220809D: to=<r@ourc
+orpdomain.com>, size=18458, nrcpt=1 (queue active)
Jun  7 15:44:47 gw3 postfix/smtpd[32026]: disconnect from exch01.windo
+main.ourdomain.gov.au[172.16.10.173]
Jun  7 15:44:47 gw3 postfix/smtpd[31899]: 7A98C20809E: client=localhos
+t.localdomain[127.0.0.1]
Jun  7 15:44:47 gw3 postfix/smtp[31344]: EBBF220809B: to=<r@ourcorpdom
+ain.com>, relay=exch04.windomain.ourdomain.gov.au[172.16.65.6], delay
+=1, status=sent (250 2.6.0  <8A00D9112060F14CA34EBB00B8E4715C012CB31A
+@atug2k.ATUG.local> Queued mail for delivery)
Jun  7 15:44:47 gw3 postfix/qmgr[22316]: EBBF220809B: removed
Jun  7 15:44:47 gw3 postfix/cleanup[31605]: 7A98C20809E: message-id=<5
+6D3D9B855E3D94287CD8C8460B9999C030F1EFF@exch01.windomain.ourdomain.go
+v.au>
Jun  7 15:44:47 gw3 postfix/qmgr[22316]: 7A98C20809E: to=<r@ourcorpdom
+ain.com>, size=18667, nrcpt=1 (queue active)
Jun  7 15:44:47 gw3 postfix/smtp[31901]: 7763220809D: to=<JL@aph.gov.a
+u>, relay=localhost[127.0.0.1], delay=0, status=sent (250 Ok: queued 
+as 7A98C20809E)
Jun  7 15:44:47 gw3 postfix/qmgr[22316]: 7763220809D: removed
Jun  7 15:44:47 gw3 postfix/smtp[29095]: 7A98C20809E: to=<JL@aph.gov.a
+u>, relay=smtp1.aph.gov.au[202.14.81.8], delay=0, status=sent (250 sm
+tp1.aph.gov.au: Message accepted for delivery)
Jun  7 15:44:47 gw3 postfix/qmgr[22316]: 7A98C20809E: removed
Jun  7 15:44:49 gw3 postfix/smtpd[31899]: disconnect from localhost.lo
+caldomain[127.0.0.1]
Jun  7 15:44:51 gw3 postfix/smtpd[28184]: connect from iptel.kbrnet.ru
+[62.183.83.35]
Jun  7 15:44:54 gw3 postfix/smtpd[28184]: NOQUEUE: reject: RCPT from i
+ptel.kbrnet.ru[62.183.83.35]: 554 Service unavailable; Client host [6
+2.183.83.35] blocked using WFD.q.mail-abuse.com; Mail from 62.183.83.
+35 deferred using Trend Micro Email Reputation database. Please see <
+http://www.mail-abuse.com/cgi-bin/lookup?62.183.83.35>; from=<dppolo@
+madones.com> to=<r@ourcorpdomain.com> proto=SMTP helo=<iptel.kbrnet.r
+u>
Jun  7 15:44:54 gw3 postfix/smtpd[31792]: lost connection after DATA f
+rom unknown[58.54.60.137]
Jun  7 15:44:54 gw3 postfix/smtpd[31792]: disconnect from unknown[58.5
+4.60.137]
Jun  7 15:44:55 gw3 postfix/smtpd[28184]: lost connection after RCPT f
+rom iptel.kbrnet.ru[62.183.83.35]
Jun  7 15:44:55 gw3 postfix/smtpd[28184]: disconnect from iptel.kbrnet
+.ru[62.183.83.35]
Jun  7 15:44:55 gw3 postfix/smtpd[32294]: warning: 203.20.159.130: hos
+tname mail50.gsjbw.com verification failed: Name or service not known
Jun  7 15:44:55 gw3 postfix/smtpd[32294]: connect from unknown[203.20.
+159.130]
[download]