I want to build a list from maillog, maillog.x containing something like Date, Sender's email, Recipient's Email and subject of the message filtering output emails and output domain.

I've read about importing from spreadsheet program a csv file. The issue is I have to add field separators in log file. I couldn't figure out how to customize that. How can I do that, the list and the separator?

This is an example of sending mail log

Jun 11 15:24:58 host postfix/cleanup[19060]: F41C660D98A0: warning: header Subject: TESTING SUBJECT from unknown[XXX.XXX.XXX.XXX]; from=sender@sender.com> to=recipient@recipient.com> proto=ESMTP helo=<[]>
Jun 11 15:25:01 host postfix/smtp[19062]: F41C660D98A0: to=<me@me.com>, relay=mx-rl.com[xxx.xxx.xxx.xxx]:25, delay=3.4, delays=0.66/0.01/0.86/1.9, dsn=2.0.0, status=sent (250 <538E30D9000A1DD8> Mail accepted)

The list would contain the subject, from, and to, filtering by to = ...@recipient.com


2 Answers 2


Try aillog-hashnize.pl from https://gist.github.com/xtetsuji/1446584 It is a perl script to parse maillog file and produce output file as CSV. Then import CSV into Excel and apply filter as you wish (@recipient.com).

perl maillog-hashnize.pl -y 2016 maillog-20160124 > maillog.csv


You could try opening it with LibreOffice, It asks you for the separator when you open a CSV file. For that to work you would have to rename the file as maillog.csv so that LibreOffice knows that it is a CSV file.

I suspect that won't work well. Instead, I would get things in the right format with Unix command line tools first.

Use grep to only show the lines with a recipient that you are interested in:

grep -E 'to=[a-z]+\@recipient\.com' 

Use sed to remove the parts of the line you don't need. Sed uses s/find/replace/g syntax. I would use four find and replaces like this:

sed -r 's/.*Subject: //g;s/ from .* from=/\t/g;s/ to=/\t/g;s/ proto=.*//g'

Putting it all together would be this command line:

cat maillog.x | grep -E 'to=[a-z]+\@recipient\.com' | sed -r 's/.*Subject: //g;s/ from .* from=/\t/g;s/ to=/\t/g;s/ proto=.*//g' > /tmp/maillist.csv

Then /tmp/maillist.csv would contain:

TESTING SUBJECT sender@sender.com>  recipient@recipient.com>
  • 1) I forgot to add the date of the transaction 2) Output file contains extra data like: SUBJECT <user@sender.com> <user@recipient.com> Jun 12 15:23:00 host postfix/smtp[13074]: 1997C60D9943: <user@recipient.com>, relay=mx4.recipient.com[yyy.yyy.yyy]:25, delay=8.4, delays=6.4/0.01/0.54/1.5, dsn=2.0.0, status=sent (250 <000401cf866b$528f2810$f7ad7830$sender.com> Queued mail for delivery) 3) Separator is Tab?
    – dstonek
    Jun 12, 2014 at 23:20
  • I get two lines: Subject-Sender-Recipient and the other starting with the date I commented above. I also need the date I guess I can get with something like substring(1,16)
    – dstonek
    Jun 16, 2014 at 1:36

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.