if [ -z "$1" ] ; then
   day=`date -d yesterday '+%b %e'`
else
   day=`date -d "$1" '+%b %e'`
fi
MAXSERVERS=5
users=$(grep "^$day" /var/log/maillog|grep authid= |awk -F, '{print substr($3,9),substr($2,8)}' | sort | uniq | awk '{print $1}' | uniq -c | sort -rn | awk -v maxs=$MAXSERVERS '{if ($1 > maxs) {print $2}}')
(
if [ -z "$1" ] ; then
   echo -e "`date -d yesterday '+%a %b %d %Y'`: smtp security report"
else
   echo -e "`date -d "$1" '+%a %b %d %Y'`: smtp security report"
fi
echo -e "\nUsers that logged on SMTP from more than $MAXSERVERS different IP:\n"
grep "^$day" /var/log/maillog|grep authid= |awk -F, '{print substr($3,9),substr($2,8)}' | sort | uniq | awk '{print $1}' | uniq -c | sort -rn | awk -v maxs=$MAXSERVERS '{if ($1 > maxs) {print $0}}'
echo -e "\nOriginating servers for above users:\n"
for user in $users ; do
grep "^$day" /var/log/maillog|grep authid= | grep $user |awk -F, '{print substr($3,9),substr($2,8)}' | sort | uniq
done
echo -e "\nSMTP authentication failures (list limited to 300 lines):\n"
grep "^$day" /var/log/messages|grep saslauthd| grep failure|awk '{print substr($10,7,length($10)-7)}'|sort |uniq -c |sort -rn|head -300
) | mail -s "lxpd02 logs: smtp logins daily check" email@servizio.calcolo