sendmail log search

I wrote a sendmail log search script in Perl to perform log searches based on envelope sender, envelope recipient(s), or relay IP.

You may download the script here.

The script has the following features:

Script usage

Usage: maillog_search [OPTION]... [FILE]...

Mandatory options:
--from                search envelope sender address
--to                  search envelope recipient address(es)
--both                search envelope sender and envelope recipient address(es)
--relay               search relay IP
[FILE]...             one or more maillogs in plaintext or gzip format

Default options:
--match               return all log information with the same queue ID
--chronological-order return information in chronological order

Non-default options:
--no-match            only loop through the maillog(s) once
--queue-id-order      return information sorted by queue ID
--output-file         save results to a file
--count-only          return only the number of matches

Example usage

1. Search /var/log/maillog and /var/log/maillog.0.gz for mail (1) from, (2) to, or (3) involving relay

$ ./maillog_search --from --to --relay /var/log/maillog /var/log/maillog.0.gz

2. How many envelopes did we send with at least one recipient?
$ ./maillog_search --to --count-only /var/log/maillog

If maillog_search encounters multiple matching envelope recipients in the same envelope, such as to=<>,<>, the envelope will only be counted once.

3. Search /var/log/maillog for messages involving an envelope sender with user followed by one or more numbers with a domain of
$ ./maillog_search --from 'user[0-9]' /var/log/maillog

Back to
Last modified: 2006/03/07