Skip site navigation (1)Skip section navigation (2)
Date:      Fri, 12 Jun 2015 19:16:52 -0600
From:      jd1008 <>
Subject:   Re: Script question
Message-ID:  <>
In-Reply-To: <BAY404-EAS263BBC0728E6171BD47A4AECCBA0@phx.gbl>
References:  <BAY182-W89C2924F4BDF0D2BD3810DF4BB0@phx.gbl> <> <BAY404-EAS263BBC0728E6171BD47A4AECCBA0@phx.gbl>

Next in thread | Previous in thread | Raw E-Mail | Index | Archive | Help

On 06/12/2015 06:29 PM, Lt. Commander wrote:
> -----Original Message-----
> From: [] On Behalf Of Olivier Nicole
> Sent: Friday, June 12, 2015 7:19 PM
> To: Lt. Commander
> Cc:
> Subject: Re: Script question
> Jason,
>> I would like to be able to scan the daily maillog with a script at midnight to extract a list by selecting spam recognized and contained using the constant "score=(greater than x) and from that a list of just the IPs which will be placed in a spam file as part of a spam system here. Am tired of some getting past spamass even though it exceeds a reasonable tag level.
>> I do know how to extract just the IP from a line in the log, but not sure what the syntax should be to first ID the "score=<x" in a simple sh shell script.
> What would be the typical lines from the log?
> I;d use Perl rather than sh.
> Olivier
>> I hope this has been presented clear enough to gather some help on this task.
>> Thanks,
>> Jason
> Oliver:
> This is a typical line in the log. You see it has the info needed:
> -----------------------------------------------------------------------------------------------
> un 12 08:56:42 milter-spamc[58732]: 01937 t5CDueuM006830: spam=YES score=110.90 required=6.00 client_addr= client_name=[] subject='Re: I won't tell this secrect to anyone else...' mail=<> rcpts=<>
> -----------------------------------------------------------------------------------------------
> Thanks,
> Jason
Hi Jason,
Does the log consist of one liners as you show above?
In otherwords, is each one line entry for one message?
Are there more than 1 line per message in the log?

Want to link to this message? Use this URL: <>