pflogrep

#!/usr/bin/perl
=head1 NAME

pflogrep -- Postfix log grep complete activity

=head1 SYNOPSIS

pflogrep [-i] PATTERN [FILE]....

=head1 DESCRIPTION

Allows to grep complete activity where PATTERN was found.
Get nice stats of filtered output using pflogsumm:
  http://jimsun.linxnet.com/postfix_contrib.html

=head1 AUTHOR

Ondrej Brablc <https://github.com/brablc/>

https://github.com/brablc/postfix-tools

=cut

use Getopt::Long;

($me = $0) =~ s%.*/%%;

$Usage = "
$me [-iv] PATTERN [FILE]....

  -i  -- ignore case distinctions when matching
  -v  -- selected lines are those not matching

Examples:
  # Get only communication related to one email
  pflogrep info\@example.com mail.log | pflogsumm
  # Get communication for whole domain - print only from and to lines and color email and status
  pflogrep example.com mail.log | grep -e from= -e to= | grep --color -P \\<.*\\>\\|status
";

die $Usage unless &GetOptions( 'i', 'v' ) && (@ARGV >= 1 );

$ptn = shift;
$regex = ( $opt_i ) ?  qr/$ptn/io : qr/$ptn/o;

$exstat = 1;
$|++;  #turn off buffering for STDOUT

sub handleStream() {
    my $fh = shift;
    my %P;
    my $found = 0;

    while (<$fh>) {
        next unless /: (([0-9A-Z]{11})|NOQUEUE)/;
        $q = $1;
        $P{$q} .= $_;
        if (/: (removed$|milter-reject:)/ || $q eq 'NOQUEUE') {
            $matches = $P{$q} =~ $regex;
            if ( ($matches && !$opt_v) || (!$matches && $opt_v)) {
                print $P{$q};
                $found++;
            }
            undef $P{$q};
        }
    }
    return $found;
}

if (@ARGV==0) {
    $exstat = 0 if &handleStream(\*STDIN);
    exit( $exstat );
}

for $f ( @ARGV ) {
    unless ( open( INP, '<', $f )) {
        warn "Unable to open input file $f: $!\n";
        next;
    }
    $exstat = 0 if &handleStream(\*INP);
    close INP;
}
exit( $exstat );