On Thu, Aug 18, 2005 at 08:37:48AM -0500, Carl Wilhelm Soderstrom wrote: > > thanks for the suggestions everyone. Looks like the mail load is higher than > I thought; at least if spam is included (most of which goes to /dev/null > anyway) > > here's Mike Miller's one-liner: > [chrome at mailhost:~]$egrep '^From ' ~/Mail/procmail.log | gawk '{print $4" > "$5", "$7}' | uniq -c > 788 Aug 8, 2005 > 743 Aug 9, 2005 > 753 Aug 10, 2005 > 723 Aug 11, 2005 > 689 Aug 12, 2005 > 613 Aug 13, 2005 > 636 Aug 14, 2005 > 781 Aug 15, 2005 > 655 Aug 16, 2005 > 918 Aug 17, 2005 > 262 Aug 18, 2005 > > > and here's Florin's one-liner: > > [chrome at mailhost:~]$cd Mail > [chrome at mailhost:~/Mail]$ cat procmail.log | sed -n -e '/From [^@]*@/ > s/.* [^ ]* \([^ ]* [^ ]*\) .*/\1/p' | sort | uniq -c > 1531 Aug > 753 Aug 10 > 723 Aug 11 > 689 Aug 12 > 613 Aug 13 > 636 Aug 14 > 781 Aug 15 > 655 Aug 16 > 918 Aug 17 > 262 Aug 18 > > looks like there's a bug somewhere in that line noise of a code that doesn't > deal with single-digit dates properly. > > I'll probably stick with Mr. Miller's code (partly because I can understand > it), but thanks for the suggestions everyone! My script looks for dates as they occur _two spaces_ after some variable piece of text [1]. The awk is more straight forward but can be thrown off by extra logging at the beginning, or spaces in names. Looking at th output, it seems that my paranthesis should be \([^ ]* [ 0-9]*\) as the single digit dates seem to be padded (my logfile was cut at the 12 so I did not see that case). florin 1: You can add custom log pieces to the log, to record which rule caused a piece of mail to be filed in a certain way. For example: :0 * ^Received: from 209.98.146.184 { LOG="SPAM: Spoofs my public IP " :0 spam/iucha/ } -- Don't question authority: they don't know either! -------------- next part -------------- A non-text attachment was scrubbed... Name: not available Type: application/pgp-signature Size: 189 bytes Desc: Digital signature Url : http://shadowknight.real-time.com/pipermail/tclug-list/attachments/20050818/da9d3e78/attachment.pgp