qmail_log_parser.py

#coding: utf-8
#usage: python qmail_log_parser.py maillog | grep "_too_many_hops" | sed 's/.*@//' | sort | uniq -c
import sys

MAILLOG=sys.argv[1]
FULL_LINES=''

FAILED=[]
FAILED_TMP={}


for line in open(MAILLOG,'r'):
        parts = line.split(' ')
        if len(parts) < 9:
                continue
        if parts[6] == 'delivery' and parts[8] == 'failure:':
                FULL_LINES=FULL_LINES+line
        elif parts[6] == 'starting' and parts[7] == 'delivery':
                FULL_LINES=FULL_LINES+line
        
for line in reversed(FULL_LINES.splitlines()):
        parts = line.replace('\n','').split(' ')
        if parts[6] == 'delivery' and parts[8] == 'failure:':
                FAILED_TMP.update({parts[7]:' '.join(parts[9:])})
        elif parts[6] == 'starting' and parts[7] == 'delivery' and parts[8] in FAILED_TMP.keys():
                FAILED.append({FAILED_TMP.get(parts[8]):' '.join(parts[11:])})
                del FAILED_TMP[parts[8]]

for elements in FAILED:
        for key in elements.keys():
                print key,
                print ':::',
                print elements.get(key)