thanks for the suggestions everyone. Looks like the mail load is higher than I thought; at least if spam is included (most of which goes to /dev/null anyway) here's Mike Miller's one-liner: [chrome at mailhost:~]$egrep '^From ' ~/Mail/procmail.log | gawk '{print $4" "$5", "$7}' | uniq -c 788 Aug 8, 2005 743 Aug 9, 2005 753 Aug 10, 2005 723 Aug 11, 2005 689 Aug 12, 2005 613 Aug 13, 2005 636 Aug 14, 2005 781 Aug 15, 2005 655 Aug 16, 2005 918 Aug 17, 2005 262 Aug 18, 2005 and here's Florin's one-liner: [chrome at mailhost:~]$cd Mail [chrome at mailhost:~/Mail]$ cat procmail.log | sed -n -e '/From [^@]*@/ s/.* [^ ]* \([^ ]* [^ ]*\) .*/\1/p' | sort | uniq -c 1531 Aug 753 Aug 10 723 Aug 11 689 Aug 12 613 Aug 13 636 Aug 14 781 Aug 15 655 Aug 16 918 Aug 17 262 Aug 18 looks like there's a bug somewhere in that line noise of a code that doesn't deal with single-digit dates properly. I'll probably stick with Mr. Miller's code (partly because I can understand it), but thanks for the suggestions everyone! -- Carl Soderstrom Systems Administrator Real-Time Enterprises www.real-time.com