how to check the mail logs of "02-05-08" and for user "test"

[Maaz]

MTA: POSTFIX

# tail -f /var/log/mail |grep "test"
Jul 3 12:16:02 tiger postfix/local[6981]: 036A23178E: to=, orig_to=, relay=local, delay=1, status=sent (delivered to mailbox)
.
.
shows all the messages related to user "test",
but I need to ADD another condition..the "date", i.e I need to grep messages of user test *but only of the specific date*
I did the following
# tail -f /var/log/mail |grep "test" |grep "Jul 2"
no results ;(

need to redirect messages related to user test on June 29 on a separate file.. following also doesn't works.
grep test /var/log/mail |grep "Jun 29" >/logs/test_mail_on_JUL29.txt
or
grep test /var/log/mail |grep "Jun 29" - >/logs/test_mail_on_JUL29.txt
help

[Steven E. Protter]

Shalom,

Looks like your two step grep process will do the job.

SEP

[Ivan Ferreira]

When you need to filter a "single digit" day, you must use two spaces between the moth and the day, for example instead of "Jul 2" use "Jul 2", or a regular expresion like "Jul +2".


This command:

grep test /var/log/mail |grep "Jun 29" >/logs/test_mail_on_JUL29.txt

Should do the job. I would like to see the output of the command before the pipe.

Maybe you just don't have any mail to "test" on "Jun 29".

[Maaz]

Hi SEP and Ivan

following works fine
tail -f /var/log/mail |grep "test"

following doesnt works
tail -f /var/log/mail |grep "test" |grep "Jul 4"
two spaces in b/w "Jul and 4".

neither following works
tail -f /var/log/mail |grep "test" |grep "Jul +4"

but following works ;)
tail -f /var/log/mail |grep "test" |grep "Jul\ 4"
here two spaces after backslash(\), and before "4".

and following also works
# grep test /var/log/mail |grep "Jun\ 29" > mails.txt
here two spaces after backslash(\), and before "29".

i.e have to insert "" in b/w month and date. e.g "monthdate".

Regards

[Dennis Handly]

>Ivan: use "Jul 2", or a regular expression like "Jul +2".

"+" is an ERE, for egrep. Use "*" for a RE.

>here two spaces after backslash(\), and before "4".

Hmm, I wouldn't think you would need a "\".

[Maaz]

Hi Dennis Handly,

>"+" is an ERE, for egrep. Use "*" for a RE.

Yes following also works

# tail -f /var/log/mail |grep "test" |grep "Jul *8"
# grep test /var/log/mail |grep "Jul *8" >
mails.txt

i.e <*> works ;)