To print the email addresses with status “bounced” only from the provided log file, you can use grep to filter lines containing “status=bounced” and then use awk to extract the email addresses. Here’s how you can do it:

grep "status=bounced" /var/log/mail.log | grep -oE 'to=<[^>]+>' | awk -F'<' '{print $2}' | awk -F'>' '{print $1}'


  • grep "status=bounced" /var/log/mail.log: This grep command filters lines from the mail log file containing “status=bounced”.
  • grep -oE 'to=<[^>]+>': This grep command uses a regular expression (-oE) to extract occurrences of “to=<…>” from the filtered lines and only outputs the matching text.
  • awk -F'<' '{print $2}': This awk command uses “<” as the field separator (-F'<') and prints the second field (the part after “<“).
  • awk -F'>' '{print $1}': This awk command uses “>” as the field separator (-F'>') and prints the first field (the part before “>”).

This series of commands will extract and print only the email addresses from lines with status “bounced” in the log file, removing any surrounding characters or additional information.

Postfix mail logs, the beginning and end of a transaction

This can be identified by certain keywords and patterns in the log entries. Here’s how you can recognize them:

Beginning of a Transaction:

  • When an email transaction begins, you typically see log entries indicating the receipt of an incoming message or the initiation of an outgoing message transaction. Look for lines containing keywords such as:
    • postfix/smtpd: Indicates the Postfix SMTP server daemon handling incoming connections.
    • connect from: Indicates the start of an incoming connection from a remote host.
    • postfix/qmgr: Indicates the Postfix queue manager processing outgoing messages.
    • pickup: Indicates the Postfix pickup daemon handling locally submitted messages.

End of a Transaction:

  • The end of a transaction is usually marked by log entries indicating the final delivery or disposition of the message. Look for lines containing keywords such as:
    • status=sent: Indicates successful delivery of the message to the recipient’s mailbox.
    • status=bounced: Indicates that the message delivery failed and was bounced back to the sender.
    • status=deferred: Indicates that the message delivery was deferred and will be retried later.
    • status=reject: Indicates that the message was rejected by the server due to policy or configuration settings.
    • disconnect: Indicates the termination of an SMTP session or connection.
  • Timestamps:
    • Pay attention to timestamps in the log entries to understand the chronological order of events. The beginning of a transaction typically occurs before the end of the transaction, and the timestamps can help you determine the sequence of events.

By recognizing these keywords, patterns, and timestamps in the log entries, you can identify the beginning and end of email transactions in Postfix mail logs and understand the flow of messages through your mail server.

Now, go brew a good cup of specialty coffee from Peru and enjoy. Thanks.

Leave a comment

Your email address will not be published. Required fields are marked *