Want to go through exim logs for past 24 hours and sum up total number of emails on per user basis, please suggest me command(s)
I know how to view emails currently in queue.. but I want to find which users have sent most number of emails in past 24 hours.
Best Answer
It might depend on how your logging is setup, but I think this would work on a default system:
Which would output something like this:
What I do here is to find A= which contains the username and how they were authenticated from /var/log/exim4/mainlog, then I pipe it to
sort
anduniq -c
, which aggregates them as a group and gives you a number. The lastsort -nr
just gives me the count in an ordered group in reverse (max number first).If you have different types of authentication, let's say dovecot_plain and dovecot_login but with the same username, then the easiest way to get rid of that is to put in another grep that only get what is after ":", like so:
And the output:
Note: I have not take in account the 24h limit, since that also depends on how logging is setup, and it gets more complicated and I think this is a good start. Otherwise you need to somehow filter your log timestamps with grep to ilter the dates, then pipe that to my grep string.