Get a list of unique sender(from=) domains in postfix maillog

Question

I am currenlty trying to extract all the sender domains from maillog. I am able to do some of that with the below command but the output is not quite what I desired. What would be the best approach to retrieve a unique list of sender domain from maillog?

grep from= /var/log/maillog | awk '{print $7}' | sort | uniq -c | sort -n

output

1 from=,
1 from=,
2 from=,
2 from=,
12 reject:
666 from=<>,

desired output

test.com
app1.com
example.com

user_6918300 · Answer

This should give you the answer:

grep from= /var/log/maillog | awk '{print $7}' | grep -Po '(?=@).{1}\K.*(?=>)' | sort -n | uniq -c

... change last items to "| sort | uniq" to remove the counts.

References:

https://www.baeldung.com/linux/bash-remove-first-characters {1}\K use

Extract email addresses from log with grep or sed -Po grep function

user_874188 · Answer

See useless use of grep; if you are using Awk anyway, you don't really need grep at all.

awk '$7 ~ /from=.*@/{split($7, a, /@/); ++count[a[2]] }
  END { for(dom in count) print count[dom], dom }' /var/log/maillog

Collecting the counts in an associative array does away with the need to call sort and uniq, too. Obviously, if you don't care about the count, don't print count[dom] at the end.

Get a list of unique sender(from=) domains in postfix maillog

2 Answers