How can I awk/sed/grep the IPs from the maillog?

abefroman · 02-01-2006, 01:57 PM

# cat /var/log/maillog
Jan 29 16:43:09 server1 pop[8781]: Session Closed host=205.83.122.83 ip= user=john.smith@mydomain realuser=john.smith@mydomain totalxfer=1981
Jan 29 18:00:31 server1 pop[19092]: Login host=172.83.101.213 ip= user=john.smith@mydomain realuser=john.smith@mydomain

I want it to list the IP's only:
# cat /var/log/maillog | awk {'%d.%d.%d.%d}
205.83.122.83
172.83.101.213

My command is not correct though, does anyone know what the correct command would be?

macemoneta · 02-01-2006, 02:51 PM

From your example,

grep "host=" /var/log/maillog | awk -F\= '{print $2}'

Tinkster · 02-01-2006, 04:29 PM

Quote:

Originally Posted by macemoneta

From your example,

grep "host=" /var/log/maillog | awk -F\= '{print $2}'

Why the grep, though? :)

Code:

awk -F"=" '/host/ {sub(" ip","",$2);print $2}' maillog

The sub-bit is because of the appended " ip" in the output.

Cheers,
Tink

kshkid · 02-02-2006, 02:22 AM

one more,

Code:

sed -n '/host/p' maillog | sed -e 's/^.*host=//;s/ ip.*$//'

denver1980 · 02-02-2006, 03:58 AM

Just in case you have many process using the "host" key work in their output, use the name of the process (pop in this case).

Code:

# Server=pop
# sed -e '/pop/!d' -e 's/^.*host\=//g' -e 's/ .*$//g' /var/log/maillog

Tinkster · 02-02-2006, 11:25 AM

Or one completely without host :}

Code:

egrep -o -e "[0-9]{2,3}\.[0-9]{2,3}\.[0-9]{2,3}\.[0-9]{2,3}" maillog

Cheers,
Tink

bigearsbilly · 02-03-2006, 10:59 AM

my go

Code:

 perl -ne 'print "$&\n" while m#\d+\.\d+\.\d+\.\d+#g'

denver1980 · 03-09-2006, 10:22 AM

Wow ! That perl line is EXCELLENT !
Keeping it myself

Thx bigearsbilly