Find Postfix messages sent from one address to another
Build a paste-ready command, then review its compatibility and effects before running it.
awk -v sender=<sender-email> -v recipient=<recipient-email> 'index($0,"from=<" sender ">"){id=$6; sub(/:$/,"",id); seen[id]=1} index($0,"to=<" recipient ">"){id=$6; sub(/:$/,"",id); if(seen[id]) print}' /var/log/mail.logComplete required fields to copy the generated command.
read-onlyno known side effects Compatibility
Traditional syslog prefixUses field 6 as the Postfix queue ID. Adjust that field when a custom log prefix changes the layout.
Operational knowledgereview due 2027-01-19
Requirementsawkawk must be installed and available on PATH.
Version supportawk Current supported releasesVerified for linux using posix, bash, zsh syntax; consult compatibility notes for platform-specific differences.
Expected signalsJul 23 09:18:33 mail postfix/smtp[2208]: 4D92A2F18C: to=<bob@example.net>, relay=mx.example.net[198.51.100.24]:25, status=sent (250 2.0.0 queued)Representative successful output; values vary with the selected target and system state.
Known errorsawk: command not foundawk is missing or is not available on PATH.
Verifyawk -v sender={{sender}} -v recipient={{recipient}} 'index($0,"from=<" sender ">"){id=$6; sub(/:$/,"",id); seen[id]=1} index($0,"to=<" recipient ">"){id=$6; sub(/:$/,"",id); if(seen[id]) print}' {{logFile}}The output matches the expected target and exits without an error.Rollback noteNot required: this command is read-only and does not change system state.
Command breakdown
01awkCommandRuns the awk stage of this one-liner.
02-vOptionAssigns the following name and value before the awk program runs.
03sender=<sender-email>ParameterA value supplied in the Fill parameters section.
04-vOptionAssigns the following name and value before the awk program runs.
05recipient=<recipient-email>ParameterA value supplied in the Fill parameters section.
06'index($0,"from=<" sender ">"){id=$6; sub(/:$/,"",id); seen[id]=1} index($0,"to=<" recipient ">"){id=$6; sub(/:$/,"",id); if(seen[id]) print}'ArgumentPasses 'index($0,"from=<" sender ">"){id=$6; sub(/:$/,"",id); seen[id]=1} index($0,"to=<" recipient ">"){id=$6; sub(/:$/,"",id); if(seen[id]) print}' to awk.
07<postfix-log-file>ParameterA value supplied in the Fill parameters section.
The first rule remembers queue IDs for the sender; the second prints recipient records carrying one of those queue IDs.
Example input
awk -v sender=alice@example.com -v recipient=bob@example.net 'index($0,"from=<" sender ">"){id=$6; sub(/:$/,"",id); seen[id]=1} index($0,"to=<" recipient ">"){id=$6; sub(/:$/,"",id); if(seen[id]) print}' /var/log/mail.log
Example output
Jul 23 09:18:33 mail postfix/smtp[2208]: 4D92A2F18C: to=<bob@example.net>, relay=mx.example.net[198.51.100.24]:25, status=sent (250 2.0.0 queued)
Illustrative output — exact values vary by system and data.
Official sources
Related commands