使用 perl 解析邮件日志

Question

我在 /var/log/maillog 中有一个 maillog 文件。内容结构如下图：

Feb 13 10:13:24 mailer dove: imap-login: Login: user=<test@test.com>, method=PLAIN, rip=::ffff:14.012.251.125, lip=::ffff:33.01.121.12.80
Feb 13 10:13:25 mailer dove: imap-login: Disconnected: rip=::ffff:10.100.2.10, lip=::ffff:33.01.121.12.81
Feb 13 10:13:25 mailer dove: pop3-login: Disconnected: rip=::ffff:10.100.2.10, lip=::ffff:33.01.121.12.81
Feb 13 10:13:25 mailer dove: pop3-login: Disconnected: rip=::ffff:10.100.2.10, lip=::ffff:33.01.121.12.80
Feb 13 10:13:25 mailer dove: imap-login: Disconnected: rip=::ffff:10.100.2.10, lip=::ffff:33.01.121.12.80
Feb 13 10:13:26 mailer dove: POP3(info@nbb.com): Disconnected: Logged out top=0/0, retr=0/0, del=0/24, size=187461
Feb 13 10:13:26 mailer dove: pop3-login: Login: user=<info@bb.com>, method=PLAIN, rip=::ffff:14.012.251.125, lip=::ffff:33.01.121.12.80
Feb 13 10:13:26 mailer dove: POP3(sup@bb.com): Disconnected for inactivity top=0/0, retr=0/0, del=0/32, size=473758028
Feb 13 10:13:26 mailer dove: POP3(docs@bb.com): Disconnected for inactivity top=0/0, retr=0/0, del=0/9, size=140778365
Feb 13 10:13:26 mailer dove: pop3-login: Login: user=<jos@bb.net>, method=PLAIN, rip=::ffff:14.012.251.125, lip=::ffff:33.01.121.12.80
Feb 13 10:13:28 mailer dove: POP3(jos@bb.net): Disconnected: Logged out top=0/0, retr=1/8336, del=1/1, size=8319
Feb 13 10:13:28 mailer dove: pop3-login: Login: user=<hello@abb.com>, method=PLAIN, rip=::ffff:21.254.145.12, lip=::ffff:33.01.121.12.

我希望能够使用 perl 对其进行解析，以提取和分组用户在日志中出现的次数，并将其排序为顶部的最大大小。

我在下面尝试过，但这只会打印每个用户；

perl -ne 
 '$l{$2}=$1 if /^(.{15}) .* imap-login: 
  Login: user=<([^>]+)>/; END 
  { 
    print "$_ last imap-login: $l{$_}\n" 
    for keys %l 
  }' /var/log/maillog

你能帮我调整一下这个脚本吗？

Answer 1

尝试这样做：

perl -lne '
    $h{$1}++ if /imap-login:\s+Login:\s+user=<([^>]+)>/;
    END{
        foreach my $key (sort { $h{$a} <=> $h{$b} } keys(%h)) {
            print $key, " ", $h{$key}
        }
    }
' /var/log/mail.log

编辑

如果您想增加访问时间，请解决此问题：

perl -wlne '
    do{
        $h{$2}{inc}++;
        $h{$2}{time}="$2";
    } if /^(\w+\s+\d+\s+\d+:\d+:\d+).*?Login:\s+user=<([^>]+)>/;
    END{
        use Data::Dumper;
        print Dumper \%h;
    }
'

您只需要解析 HASH。