Hi Gurus,
I've a syslog with thousands of entries as listed below. I need to get
the size for each message. I can do this by awk like:

grep "size=" /var/log/syslog | grep "stat=Delivered" | awk '{print
$13}'

but the issue here is, if the mailbox= paramater doesn't a space in it
will work fine but if it does, then awk '{print $13}' fails to grab
the size= parameter.
e.g. - the first line works fine. - mailbox=!users/hubertp/Trash
but the 2nd doesn't.
mailbox=!users/rachels/Junk E-mail - as it has space inbetween the
name.

Any is greatly appreciated.
TIA


Mar 23 03:35:04 mailhost.test.com lmtpd: [ID 583609 mail.notice]
session=1 msgid=<200803231035.m2NAZ1q05926@jelly.test.com>
recipient=<hubertp+Trash@test.com> mailbox=!users/hubertp/Trash
size=1769 uid=449961 stat=Delivered
Mar 23 03:35:04 mailhost.test.com lmtpd: [ID 583609 mail.notice]
session=2 msgid=<000601c88cd9$0789818b$d72c7da3@fbqan>
recipient=<"rachels+Junk E-mail"@test.com> mailbox=!user
s/rachels/Junk E-mail size=3094 uid=3899 stat=Delivered
Mar 23 03:35:05 mailhost.test.com lmtpd: [ID 583609 mail.notice]
session=2 msgid=<200803231035.m2NAZ3uT013941@krb-rwc-m1.test.com>
recipient=<chata+test@test.COM> mailbox=!users/chata/Genie size=1943
uid=398167 stat=Delivered
Mar 23 03:35:06 mailhost.test.com lmtpd: [ID 583609 mail.notice]
session=2 msgid=<200803231035.m2NAZ3uT013941@krb-rwc-m1.test.com>
recipient=<"chrisj+ROOT MAIL"@test.COM> mailbox=!users/chrisj/ROOT
MAIL size=1943 uid=384947 stat=Delivered (linked)
Mar 23 03:35:06 mailhost7.test.com lmtpd: [ID 583609 mail.notice]
session=1 msgid=<200803231035.m2NAZ1q05926@jelly.gene.com>
recipient=<"chrisj+ROOT MAIL"@test.com> mailbox=!users/chrisj/ROOT
MAIL size=1769 uid=384946 stat=Delivered

explor wrote:
>
> I've a syslog with thousands of entries as listed below. I need to get
> the size for each message. I can do this by awk like:
>
> grep "size=" /var/log/syslog | grep "stat=Delivered" | awk '{print
> $13}'
>
> but the issue here is, if the mailbox= paramater doesn't a space in it
> will work fine but if it does, then awk '{print $13}' fails to grab
> the size= parameter.

replace

awk '{print $13}'

with

sed "s/.*\(size=[0-9]*\).*/\1/"

--
Best regards | Monica Lewinsky's X-Boyfriend's
Cyrus | Wife for President

explor wrote:

> grep "size=" /var/log/syslog | grep "stat=Delivered" | awk '{print
> $13}'
>
> but the issue here is, if the mailbox= paramater doesn't a space in it
> will work fine but if it does, then awk '{print $13}' fails to grab
> the size= parameter.
> e.g. - the first line works fine. - mailbox=!users/hubertp/Trash
> but the 2nd doesn't.
> mailbox=!users/rachels/Junk E-mail - as it has space inbetween the
> name.
>
> Any is greatly appreciated.

A possible solution:

awk '/size=/ && /stat=Delivered/ {match($0,/size=[[:digit:]]+/); print
substr($0,RSTART,RLENGTH)}' /var/log/syslog

--
All the commands are tested with bash and GNU tools, so they may use
nonstandard features. I try to mention when something is nonstandard (if
I'm aware of that), but I may miss something. Corrections are welcome.

In article <68a27acc-9fac-4537-9386-bfcc975a6a95@s19g2000prg.googlegroups.com>,
explor <bhaveshah@gmail.com> wrote:
>I've a syslog with thousands of entries as listed below. I need to get
>the size for each message. I can do this by awk like:
>
>grep "size=" /var/log/syslog | grep "stat=Delivered" | awk '{print $13}'
>
>but the issue here is, if the mailbox= paramater doesn't a space in it
>will work fine but if it does, then awk '{print $13}' fails to grab
>the size= parameter.
....
> Mar 23 03:35:04 mailhost.test.com lmtpd: [ID 583609 mail.notice] session=1 msgid=<200803231035.m2NAZ1q05926@jelly.test.com> recipient=<hubertp+Trash@test.com> mailbox=!users/hubertp/Trash size=1769 uid=449961 stat=Delivered
> Mar 23 03:35:04 mailhost.test.com lmtpd: [ID 583609 mail.notice] session=2 msgid=<000601c88cd9$0789818b$d72c7da3@fbqan> recipient=<"rachels+Junk E-mail"@test.com> mailbox=!user s/rachels/Junk E-mail size=3094 uid=3899 stat=Delivered
> Mar 23 03:35:05 mailhost.test.com lmtpd: [ID 583609 mail.notice] session=2 msgid=<200803231035.m2NAZ3uT013941@krb-rwc-m1.test.com> recipient=<chata+test@test.COM> mailbox=!users/chata/Genie size=1943 uid=398167 stat=Delivered
> Mar 23 03:35:06 mailhost.test.com lmtpd: [ID 583609 mail.notice] session=2 msgid=<200803231035.m2NAZ3uT013941@krb-rwc-m1.test.com> recipient=<"chrisj+ROOT MAIL"@test.COM> mailbox=!users/chrisj/ROOT MAIL size=1943 uid=384947 stat=Delivered (linked)
> Mar 23 03:35:06 mailhost7.test.com lmtpd: [ID 583609 mail.notice] session=1 msgid=<200803231035.m2NAZ1q05926@jelly.gene.com> recipient=<"chrisj+ROOT MAIL"@test.com> mailbox=!users/chrisj/ROOT MAIL size=1769 uid=384946 stat=Delivered

There are straightforward solutions to this as described in other posts, but
I'll also mention a tool I wrote specifically to extract/display fields from
logfiles with the format you show, since it's a common format:

ftp://ftp.armory.com/pub/scripts/dparamlog

In this case you would do:

dparamlog -I -nsize /var/log/syslog

or, to avoid false matches on other services that log with a size field:

awk '$5 == "lmtpd:"' /var/log/syslog | dparamlog -I -nsize

or to get output exactly as "awk '{print $13}'" would display:

awk '$5 == "lmtpd:"' /var/log/syslog | dparamlog -A= -N- -I -nsize

John
--
John DuBois spcecdt@armory.com KC6QKZ/AE http://www.armory.com/~spcecdt/

On Mar 24, 11:22am, Cyrus Kriticos <cyrus.kriti...@googlemail.com>
wrote:
> explor wrote:
>
> > I've a syslog with thousands of entries as listed below. I need to get
> > the size for each message. I can do this by awk like:
>
> > grep "size=" /var/log/syslog | grep "stat=Delivered" | awk '{print
> > $13}'
>
> > but the issue here is, if the mailbox= paramater doesn't a space in it
> > will work fine but if it does, then awk '{print $13}' fails to grab
> > the size= parameter.
>
> replace
>
> awk '{print $13}'
>
> with
>
> sed "s/.*\(size=[0-9]*\).*/\1/"
>
> --
> Best regards | Monica Lewinsky's X-Boyfriend's
> Cyrus | Wife for President

Thansk Cyrus. It Worked !!!!! Thanks again