We have worked with logs from the Apache HTTP web server. The reality is that we can apply the same ideals and methodology to any log file. We will take a look at Postfix mail logs. The mail log holds all activity from the SMTP server and we can then see who has been sending emails to whom. The log file is usually located at /var/log/mail.log. I will access this on my Ubuntu 15.10 server that has a local email delivery. All this means is that the STMP server is listening only to the localhost interface of 127.0.0.1.

The log format will change a little depending on the type of message. For example, $7 will contain from logs on outbound messages, whereas inbound messages will contain to.

If we want to list all the inbound messages to the SMTP server, we can use the following command:

$ awk '  ( $7 ~ /^to/ ) ' /var/log/mail.log  

As the string to is very short, we can add identification to it by ensuring that the field begins with to using the ^. The command and output is shown in the following screenshot:

It will be easy to extend the to or from searches to also include usernames. We can see the format of the delivered or received mail. Working with the same template we used with the Apache logs, we can easily display the highest recipient or sender.