Relay-Version: version B 2.10 5/3/83; site utzoo.UUCP Path: utzoo!watmath!clyde!cuae2!ihnp4!inuxc!pur-ee!j.cc.purdue.edu!rsk From: rsk@j.cc.purdue.edu.UUCP Newsgroups: news.misc,comp.mail.misc Subject: Two perhaps-useful awk scripts for news and mail Message-ID: <2731@j.cc.purdue.edu> Date: Thu, 11-Dec-86 12:47:52 EST Article-I.D.: j.2731 Posted: Thu Dec 11 12:47:52 1986 Date-Received: Sun, 14-Dec-86 15:25:01 EST Distribution: net Organization: Purdue University Computing Center Lines: 73 Keywords: news, mail, logs, summary Xref: watmath news.misc:111 comp.mail.misc:9 These two awk scripts process the information contained in the logs kept by news (2.10.3 at least; haven't brought up 2.11 yet) and mail (4.2 or 4.3 bsd, don't know about system V and friends) into a form that some people find a little more useful; they are emphatically hacks, and are therefore not elegant, efficient, or anything like that--however, they do the job. The usage for each is given below. Note that parts of the script for mail are commented out; if you want to keep track of ftp or finger connections, remove the comments. Similarly, the news script counts articles but does not print out the count. The basic idea behind these is that both news and mail make a multi-line entry for each transaction that they handle. The scripts produce one line per transaction, where are a transaction is either a letter or an article, respectively. Typical output for mail.awkfile looks like this: Dec 11 12:25:04-- size=5686, from=xs0, to=joe@h.cc.purdue.edu, message-id=<8612111724.AA08095@j.cc.purdue.edu> Dec 11 12:14:10-- size=2510, from=boncolo, to=snarf@tb.cc.cmu.edu, message-id=<8612111711.AA07717@j.cc.purdue.edu> Dec 11 12:13:49-- size=8219, from=nobish, to=samurai@ee.ecn.purdue.edu, message-id=<8612111712.AA07735@j.cc.purdue.edu> Typical output for news.awkfile looks like this: acs amdahl.UUCP comp.sys.amiga 'VT100 Beeps!' penick hplabsc.UUCP misc.consumers 'Re: MORE card' peterson milano.UUCP comp.graphics 'Geographic data bases' prindle nadc.arpa comp.sys.misc 're: CP/M Wordstar files' Note that these scripts just pick out the information I deemed useful to me; in the case of mail, that was sender/recipient(s)/date/time/size/message-id; in the case of news, that was sender/site/newsgroup(s)/subject. Of course, it's pretty easy to post-process these to remove extraneous junk, columnize them, and so on, but I figure everyone will want something different. If you have comments, suggestions, or improvements, please send them to me via MAIL; I will be happy to summarize, digest, and so on, and follow up this article at a later date. -- Rich Kulawiec, rsk@j.cc.purdue.edu, j.cc.purdue.edu!rsk ========== mail.awkfile; usage is "awk -f mail.awkfile < /usr/spool/mqueue/syslog" ========== BEGIN {fromcount = 0; sizecount = 0; tocount = 0; midcount = 0} / sendmail.*: from/ { from[$6] = $7; fromcount++ } / sendmail.*: from/ { size[$6] = $8; sizecount++ } / sendmail.*: to/ { to[$6] = $7; tocount++ } / sendmail.*: message-id/ { mid[$6] = $7; midcount++; month[$6] = $3; day[$6] = $4; time[$6] = $5} # /.* fingd.*/ { fingfrom[$2] = $6; fingto[$2] = $9} # /.* ftpd.* connection from/ { ftpfrom[$2] = $8} END { for ( i in from ) { printf("%s %s %s %s %s %s %s\n",month[i],day[i],time[i],size[i],from[i],to[i],mid[i]) } # for ( i in ftpfrom ) { # printf("ftp from %s\n",ftpfrom[i]) # } # for ( i in fingfrom ) { # printf("%s finged %s\n",fingfrom[i],fingto[i]) # } } ========== news.awkfile; usage is "awk -f news.awkfile < /usr/local/lib/news/log" ========== BEGIN {artcount = 0} /.* received */ { ng[$6] = $8; subja[$6] = $10; subjb[$6] = $11; subjc[$6] = $12; subjd[$6] = $13; subje[$6] = $14; subjf[$6] = $15; subjg[$6] = $16; subjh[$6] = $17; subji[$6] = $18; subjj[$6] = $19; artcount++ ; artid = $6 } /.* from */ { from[artid] = $6 } END { for ( i in ng ) { printf("%s\t%s\t%s %s %s %s %s %s %s %s %s %s\n",from[i],ng[i],subja[i],subjb[i],subjc[i],subjd[i],subje[i],subjf[i],subjg[i],subjh[i],subji[i],subjj[i]) } }