Relay-Version: version B 2.10 5/3/83; site utzoo.UUCP
Path: utzoo!watmath!clyde!cuae2!ihnp4!inuxc!pur-ee!j.cc.purdue.edu!rsk
From: rsk@j.cc.purdue.edu.UUCP
Newsgroups: news.misc,comp.mail.misc
Subject: Two perhaps-useful awk scripts for news and mail
Message-ID: <2731@j.cc.purdue.edu>
Date: Thu, 11-Dec-86 12:47:52 EST
Article-I.D.: j.2731
Posted: Thu Dec 11 12:47:52 1986
Date-Received: Sun, 14-Dec-86 15:25:01 EST
Distribution: net
Organization: Purdue University Computing Center
Lines: 73
Keywords: news, mail, logs, summary
Xref: watmath news.misc:111 comp.mail.misc:9

These two awk scripts process the information contained in the logs kept
by news (2.10.3 at least; haven't brought up 2.11 yet) and mail (4.2 or
4.3 bsd, don't know about system V and friends) into a form that some people
find a little more useful; they are emphatically hacks, and are therefore
not elegant, efficient, or anything like that--however, they do the job.

The usage for each is given below.  Note that parts of the script for mail
are commented out; if you want to keep track of ftp or finger connections,
remove the comments.  Similarly, the news script counts articles but
does not print out the count.

The basic idea behind these is that both news and mail make a multi-line
entry for each transaction that they handle.   The scripts produce one line
per transaction, where are a transaction is either a letter or an article,
respectively.  Typical output for mail.awkfile looks like this:

Dec 11 12:25:04-- size=5686, from=xs0, to=joe@h.cc.purdue.edu, message-id=<8612111724.AA08095@j.cc.purdue.edu>
Dec 11 12:14:10-- size=2510, from=boncolo, to=snarf@tb.cc.cmu.edu, message-id=<8612111711.AA07717@j.cc.purdue.edu>
Dec 11 12:13:49-- size=8219, from=nobish, to=samurai@ee.ecn.purdue.edu, message-id=<8612111712.AA07735@j.cc.purdue.edu>

Typical output for news.awkfile looks like this:

acs	amdahl.UUCP	comp.sys.amiga	'VT100 Beeps!'        
penick	hplabsc.UUCP	misc.consumers	'Re: MORE card'       
peterson	milano.UUCP	comp.graphics	'Geographic data bases'       
prindle	nadc.arpa	comp.sys.misc	're: CP/M Wordstar files'      

Note that these scripts just pick out the information I deemed useful to me;
in the case of mail, that was sender/recipient(s)/date/time/size/message-id;
in the case of news, that was sender/site/newsgroup(s)/subject.
Of course, it's pretty easy to post-process these to remove extraneous junk,
columnize them, and so on, but I figure everyone will want something different.
If you have comments, suggestions, or improvements, please send them to
me via MAIL; I will be happy to summarize, digest, and so on, and follow
up this article at a later date.

-- 
Rich Kulawiec, rsk@j.cc.purdue.edu, j.cc.purdue.edu!rsk

==========
mail.awkfile; usage is "awk -f mail.awkfile < /usr/spool/mqueue/syslog"
==========
BEGIN {fromcount = 0; sizecount = 0; tocount = 0; midcount = 0}
/ sendmail.*: from/		{ from[$6] = $7; fromcount++ }
/ sendmail.*: from/		{ size[$6] = $8; sizecount++ }
/ sendmail.*: to/		{ to[$6] = $7; tocount++ }
/ sendmail.*: message-id/	{ mid[$6] = $7; midcount++; month[$6] = $3;  day[$6] = $4;  time[$6] = $5}
# /.* fingd.*/			{ fingfrom[$2] = $6; fingto[$2] = $9}
# /.* ftpd.* connection from/	{ ftpfrom[$2] = $8}

END { for ( i in from ) {
		printf("%s %s %s %s %s %s %s\n",month[i],day[i],time[i],size[i],from[i],to[i],mid[i])
      }
#     for ( i in ftpfrom ) {
# 	printf("ftp from %s\n",ftpfrom[i])
#      }
#     for ( i in fingfrom ) {
#	printf("%s finged %s\n",fingfrom[i],fingto[i])
#      }
}

==========
news.awkfile; usage is "awk -f news.awkfile < /usr/local/lib/news/log"
==========
BEGIN {artcount = 0}
/.*	received */		{ ng[$6] = $8; subja[$6] = $10; subjb[$6] = $11; subjc[$6] = $12; subjd[$6] = $13; subje[$6] = $14; subjf[$6] = $15; subjg[$6] = $16; subjh[$6] = $17; subji[$6] = $18; subjj[$6] = $19; artcount++ ; artid = $6 }
/.*	from */			{ from[artid] = $6 }

END { for ( i in ng ) {
		printf("%s\t%s\t%s %s %s %s %s %s %s %s %s %s\n",from[i],ng[i],subja[i],subjb[i],subjc[i],subjd[i],subje[i],subjf[i],subjg[i],subjh[i],subji[i],subjj[i])
      }
}