# HG changeset patch
# User Heiko Schlittermann <hs@schlittermann.de>
# Date 1259735879 -3600
# Node ID fc91e5013dbbebed38d547440408d86621d4495b

search and reorder postfix logs (similar to exigrep)

diff -r 000000000000 -r fc91e5013dbb .hgignore
--- /dev/null	Thu Jan 01 00:00:00 1970 +0000
+++ b/.hgignore	Wed Dec 02 07:37:59 2009 +0100
@@ -0,0 +1,1 @@
+logs/
diff -r 000000000000 -r fc91e5013dbb postgrep
--- /dev/null	Thu Jan 01 00:00:00 1970 +0000
+++ b/postgrep	Wed Dec 02 07:37:59 2009 +0100
@@ -0,0 +1,51 @@
+#! /usr/bin/perl
+use strict;
+use warnings;
+use Date::Parse;
+use Memoize;
+use Smart::Comments;
+
+my %msglog;
+my %removed;
+
+memoize("str2time");
+
+while (<>) {
+    chomp;
+
+    /^(?<date>.{15})
+    \s(?<host>\S+)
+    \s(?<service>\S+):
+    \s(?<pfid>[[:xdigit:]]+):
+    \s(?<rest>.*)
+    /x	or next;
+
+    my $ts = str2time($+{date});
+
+    push @{$msglog{$+{pfid}}}, $_;
+
+    # a "removed" line does not have to be the last
+    # line for a message, sometimes the qmgr logs a bit
+    # later (mostly during the same second)
+
+    # thus remember the "removed" ID we've seen
+    if ($+{rest} eq "removed") {
+	push @{$removed{$ts}}, $+{pfid};
+    }
+
+    # and count all IDs with "removed" older than 60 seconds as
+    # completed
+    foreach (grep { ($ts - $_) > 60 } keys %removed) {
+
+	foreach (@{delete $removed{$_}}) {
+	    print join "\n", @{delete $msglog{$_}}, "", "";
+	}
+    }
+
+
+}
+
+# the rest 
+foreach (values %msglog) {
+    print join "\n", @$_, "", "";
+}