[LUNI] Help with awk

[Joe Frost]

On Mon, Apr 05, 2004 at 07:28:49AM -0500, Stef wrote:
> 
> On Apr 5, 2004, at 5:45 AM, Joe Frost wrote:
> 
> >On Mon, Apr 05, 2004 at 12:37:48AM -0500, Stef wrote:
> >>I am sorry if this is not the right place, but I have this desperate
> >>need to resolve an issue with a Postfix honeypot, and - as not much of
> >>a shell script person - I am stuck with a problem: I want to determine
> >>and print out the messages in the queue, whose size are between
> >>(0-2000), (3000-7000) and >8000 (second field in postqueue -p output),
> >>but I can either eliminate the last line, nor put a LF between each
> >>value found (let alone passing these values to some other script, to
> >>process the field ID). Here is what I have now:
> >>
> >># postqueue -p |awk '$2 !~ /ID/ && ($2 < 2000 || ($2 > 3000 && $2 <
> >>7000) || $2 > 8000) {printf $2} END {printf "\n"}'
> >>
> >>which will eliminate the ID field, but not the space between multiple
> >>occurrences, neither the last line (with the totals) ...
> >>
> >>... anybody with any ideas here?!?
> >
> >Could you send a snippet of the postqueue -p output?
> >
> >Joe
> >
> 
> Joe,
> 
> Now that you were so kind as to look further into this, here is what I 
> need to do:
> 
> #postqueue -p
> 
> -Queue ID- --Size-- ----Arrival Time-------------- 
> -Sender/Recipient-------
> 
> 2A79D320D2E!    7368 Mon Apr  5 00:18:51  	from at from-domain.com
>                                          					to at inoccent.org
> 
> 7673F320FDF!    2814 Mon Apr  5 00:34:00  	from at another-domain.com
>                                          					to at inoccent1.com
>                                          					to @inoccent2.com
>                                          					to at inoccent3.com
>                                         				 	to at inoccent4.com
>                                          					
> 4514B3214F6!     729 Mon Apr  5 03:11:50  	from at test-domain.com
>                                          					to at address-of-spammer.com
> 
> 
> 		... and on and on, with the last line summarizing what is in 
> 		the queue (by the way - for those in the Postfix "know" - I am 	 
> putting everything in the HOLD queue, to further analyze, which is why I 
> can play with these at my own leisure) ... and 		the final 
> line is the one summarizing the whole queue, as:
> 
> -- 35385 Kbytes in 5026 Requests.
> 

Try this 

# postqueue -p | \
awk '/^[0-9A-F]/ && \
($2 < 2000 || ($2 > 3000 && $2 < 7000) || $2 > 8000 ) \
{print $2}'

Ignore the line wraps if you want.  Just trying to make it legible.
I assumed that the first character of the line is always going to be hex
to eliminate the header and total.

Joe