☰

ログから情報を抽出する

tag-icon • tag-icon shell-script text-processing
ログから情報を抽出する

grep3番目のフィールド「email sender」はgrepできません。最初の2つのフィールドでこのコマンドを使用するとき：

echo "TimeStamp  Email To:  Email From:" && awk '{print $1,$6}' logs

丸太：

2016-05-23 11:01:40 [1005583] 1b4ivg-004DZf-GX ** [email protected] F=<abbas@DomainName> P=<abbas@DomainName> R=dkim_lookuphost T=dkim_remote_smtp H=mx2.hotmail.com [65.54.188.72]:25 I=[IP Address]:56910 X=TLSv1.2:ECDHE-RSA-AES256-SHA384:256 CV=yes DN="/CN=*.hotmail.com": SMTP error from remote mail server after MAIL FROM:<abbas@DomainName> SIZE=275286: 550 SC-001 (BAY004-MC1F14) Unfortunately, messages from IP Address weren't sent. Please contact your Internet service provider since part of their network is on our block list. You can also refer your provider to http://mail.live.com/mail/troubleshooting.aspx#errors.
2016-05-23 11:12:53 [1015989] 1b4j6h-004GIq-Ob ** [email protected] F=<corporate-kbl@DomainName> P=<corporate-kbl@DomainName> R=lookuphost T=remote_smtp H=mx3.hotmail.com [65.55.37.120]:25 I=[IP Address]:51605 X=TLSv1.2:ECDHE-RSA-AES256-SHA384:256 CV=yes DN="/CN=*.hotmail.com": SMTP error from remote mail server after MAIL FROM:<corporate-kbl@DomainName> SIZE=17484: 550 SC-001 (COL004-MC4F44) Unfortunately, messages from IP Address weren't sent. Please contact your Internet service provider since part of their network is on our block list. You can also refer your provider to http://mail.live.com/mail/troubleshooting.aspx#errors.

取得したい：

 Timestamp:        Email To:               Email From:
 2016-05-23        [email protected]     abbas@DomainName
 2016-05-23        [email protected]       corporate-kbl@DomainName

「$7」の代わりに「F=<>」で3番目のフィールドのメールアドレスを探す必要があります。以下のログで「$ 7」フィールドをgrepすると、受信者アドレスが提供されます。

 2016-05-23 10:19:03 [954152] 1b4iGS-004027-BM ** [email protected] ([email protected]) <[email protected]> F=<[email protected]> P=<[email protected]> R=lookuphost T=remote_smtp H=mx2.hotmail.com [65.55.37.120]:25 I=[136.243.219.141]:35485 X=TLSv1.2:ECDHE-RSA-AES256-SHA384:256 CV=yes DN="/CN=*.hotmail.com": SMTP error from remote mail server after MAIL FROM:<[email protected]> SIZE=375119: 550 SC-001 (COL004-MC4F12) Unfortunately, messages from 136.243.219.141 weren't sent. Please contact your Internet service provider since part of their network is on our block list. You can also refer your provider to http://mail.live.com/mail/troubleshooting.aspx#errors.

`

答え1

何について

  awk '{ printf "%s\t%s\t%s\n",$1,$6,substr($7,4,length($7)-4) ;} ' logs

またはタイトルとして

  awk 'BEGIN {printf "%s\t%s\t%s\n","Timestamp","email to","email from" }
             { printf "%s\t%s\t%s\n",$1,$6,substr($7,4,length($7)-4) ;} ' logs

新しい精度アップデート

awk 'NF>6 { d=6 ; while ( ! ($d ~ /^F=/ ) ) d++ ; printf "%s\t%s\t%s\n",$1,$6,substr($d,4,length($d)-4) ;} ' logs

どこ

  • NF > 6フィールドが6つ以上あることを確認してください。
  • d=6 ; while ( ! ($d ~ /^F=/ ) ) d++フィールドをスキャンし、F=そのフィールドがないと無限ループが発生することに注意してください。
  • substr($d,4,length($d)-4)前と同様に、見つかったフィールドから抽出します。

これは

2016-05-23      [email protected]     abbas@DomainName
2016-05-23      [email protected]       corporate-kbl@DomainName
2016-05-23      [email protected]    [email protected]

関連情報