How to search logs for an email address

[yonatan]

I've got a bit of a "situation" and I need to search the logs on my Zimbra server to see if mail has been sent or received from a particular email address.

Can someone please show me the command(s) necessary.

Thanks

[Linux2012]

Originally Posted by yonatan

I've got a bit of a "situation" and I need to search the logs on my Zimbra server to see if mail has been sent or received from a particular email address.

Can someone please show me the command(s) necessary.

Thanks

To search the most recent log

grep user@domain.com /var/log/zimbra.log | more

However the older logs are compressed, which requires more effort:

for i in /var/log/zimbra.log.*.gz ; do gunzip -c $i | grep user@domain.com | more; done;

You can vary this a bit and find just the "to" address using...

for i in /var/log/zimbra.log.*.gz ; do gunzip -c $i | grep "to=<user@domain.com>" | more; done;

[yonatan]

Excellent just what I needed! Thank you very much Linux2012

[vavai]

Zimbra 7 has a feature tracking :

/opt/zimbra/libexec/zmmsgtrace -s "sender@domain.tld"

or

/opt/zimbra/libexec/zmmsgtrace -r "recipient@domain.tld"

CLI zmmsgtrace - Zimbra :: Wiki

zmmsgtrace was available on Zimbra 5, disappeared on Zimbra 6 and back on Zimbra 7