Mail log IP address count

The following monster will parse the mail log and report on unique host connections along with a count.

cat /var/log/mail.log | \
  grep ' connect from unknown' | \
  awk '{ print $8 }' | \
  sort | \
  sed -n 's/.*\[\([0-9]\{1,3\}\.[0-9]\{1,3\}\.[0-9]\{1,3\}\.[0-9]\{1,3\}\)\].*/\1/p' | \
  awk '{count[$1]++} END {for (word in count) print count[word], word}' | \
  sort -n

Removing colour code special characters with sed

I want to post-process the output of an ‘ls’ command with ‘sed’ so that I can remove the ‘./’ prefixes that I can’t avoid going into the ls output (this is a result of using ‘find’ safely).

The thing is, if I pipe ls output to sed, then the default –color=auto setting applies and ls detects that it’s not talking to a terminal so doesn’t output colour codes. But I want colour codes, usually, so I need to change the ls command to use –colour=always, which I’ve done. This means I can have colour and also have sed format the ls output.

The problem is then what happens if I want to pipe my output to ‘less’? Then the colour code commands appear as garbage in the output stream. So, usually I want colour codes, and sometimes I don’t.

I found this article, Remove color codes (special characters) with sed, which helped me come up with the following bash alias:

 alias noco='sed -r "s/\x1B\[([0-9]{1,2}(;[0-9]{1,2})?)?[m|K]//g"'

So now that I have the ‘noco’ alias (short for “no colour”) I can pipe my output through that if I want the colour codes removed, which I can apply before piping output to less.

It’s a little bit annoying that I have to do things this way but I haven’t been able to think of a better way to make it all work and this all seems to get the job done.