Hi,
I have a script that checks my maillog and prints useful information.

#!/bin/bash
#
# Script to parse postfix logs for issues to report
# Created: 2009-12-30
# Changed: 2009-12-31 Added more detail: relaying, RBLs

LOGFILE=${logfile:-/var/log/maillog}
echo "Checking for relaying"
relay=`egrep "postfix\/smtpd?\[[0-9]*\]: [NOQUA-F]+:"  ${LOGFILE} | egrep -v "due to listing in|Sender address rejected|Client host rejected|Recipient address rejected" | sed '/Relay access denied/s/^\(.*\) postfix\/smtpd.*from=\([^ ]*\) to=\([^ ]*\) proto=.*/From: \2 To: \3 On: \1/' | sed -e 's/ To:/\nTo:/g' -e 's/ On:/\nOn:/g'`

echo "Relaying denied from:"
echo "$relay" | grep "^From: " | sed 's/^From: //g' | sort | uniq -c | sort -rn
echo "Relaying denied to:"
echo "$relay" | grep "^To: " | sed 's/^To: //g' | sort | uniq -c | sort -rn

rbl=`egrep "postfix\/smtpd?\[[0-9]*\]: [NOQUA-F]+:"  ${LOGFILE}\
   | egrep -v "Relay access denied|Sender address rejected|Client host rejected|Recipient address rejected" \
   | sed '/due to listing in/s/.*due to listing in \([^:]*\):.*from=\([^ ]*\).* to=\([^ ]*\).*/From: \2 To: \3 RBL: \1/g' \
   | sed -e 's/ To:/\nTo:/g' -e 's/ RBL:/\nRBL:/g'`

echo -n "Total RBL blocks: "
echo "$rbl" | grep "^To: " | wc -l
echo "RBL blocked email to:"
echo "$rbl" | grep "^To: " | sed 's/^To: //g' | sort | uniq -c | sort -rn
echo "RBLs:"
echo "$rbl" | grep "^RBL: " | sed 's/^RBL: //g' | sort | uniq -c | sort -rn

echo "Checking for new postfix errors"
egrep "postfix\/smtpd?\[[0-9]*\]: NOQUEUE:" ${LOGFILE} | egrep -v "Relay access denied|due to listing in|Sender address rejected|Client host rejected|Recipient address rejected" || echo "      none."

echo "Statistics"
egrep 'postfix\/smtpd' ${LOGFILE} | egrep -v 'NOQUEUE:|connect from|client=' | sed -e 's/.*smtpd\[[0-9]*\]: //' -e 's/lost connection.*/lost connection/' -e 's/warning.*/warning/' -e 's/timeout.*/timeout/' -e 's/too many errors.*/too many errors/' -e 's/.*reject.*/other reject/' | sort | uniq -c | sort -rg

I want to add to this wonderful script a section that prints
all the email address of the emails sent by postfix.

Can you help in writing this section?

It seems that I founded a good way to do it.
grep -o 'to=<[^@]*@.[^>]*' /var/log/maillog

not an excellent solution since it prints also my mail dir,
this is better:
grep -o 'to=<[^@]*@.[^>]*' maillog-20131003 | grep -v "myemailadddress@domain.org"

this one removes the email I received.

Use

pflogsumm /var/log/mail.log

no need to reinvent the wheel.

_________________
Paid support
How to ask for help
1. Give details of your problem
2. Post any errors
3. Post relevant logs.
4. Don't hide details i.e. your domain, it just makes things harder
5. Be polite or you'll be eaten by a grue

thanks obs, great tool.
is there a way to remove the sections "by message size" in the pflogsumm output?

"-u 0" will remove both the "by message size" and "by message count" sections, but I'm not sure you can control them separately.

I don't want to remove both sections but I don't want unuseful duplicated section.
"by count" is enough for me, no need for an additional "by size" section.
need to find a solution if I want to use pflogsumm... mmmm...

Sincerely I don't understand the output of the pflogsumm.



I have sent only 4 email after the maillog has been rotated,
there is only four "sent" lines in the maillog.
Why pflogsumm says that 18 delivered ????

It seems that the delivered value contains both the sent and received, why?

The senders sections contains the hosts of the people who sent me emails from external domain.
Strange. Any idea?

pflogsumm is unsable in a normal email environment.
its results are broken if using an antivirus/antispam/dovecot lmtp.

personally I don't use any antivirus/antispam except from some RBL but I use dovecot lmtp for sieve.
The pflogsumm results in this case is wrong.
Why it is wrong?
When I receive an email the email is filetered by lmtp and than sent to my mailbox, this makes pflogsumm counts 2 email, one received and one sent.

quite an unuseful command, I return to my script
I think that this is the reason why I need to reivent the wheel