• Find IPs connecting to a postfix server through logs

    There’s no easy way to list all the IPs connecting to your postfix server for sending mail. But you can easily extract them from all your postfix logs.

    For our example, we will consider the logs from postfix to be as default and located in /var/log/maillog

    Here is what a postfix log look like when a connection is received:

    Sep  1 10:22:32 mail-server-01 postfix/smtpd[700]: connect from ha-lb-03[]

    For extracting exclusively the IPs, we will use a combination of commands:

    $ grep " connect from " /var/log/maillog |cut -d '[' -f3 |cut -d ']' -f1 |sort -u
    • grep ” connect from ” /var/log/maillog will extract every lines containing a connection attempt
    • cut -d ‘[‘ -f3 |cut -d ‘]’ -f1 will extract the IP from the line (which is contained between [] )
    • sort -u will sort the output by unique values

    Here is what we will get as a result once the command is executed (nothing will appear until it finished):

    $ grep " connect from " /var/log/maillog |cut -d '[' -f3 |cut -d ']' -f1 |sort -u

    You can obviously re-use this command for any log file that you want to filter out by updating the filtering.