Ask Ubuntu is a question and answer site for Ubuntu users and developers. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am using the following command to find log entries that are the result of a log in to the email server:

egrep '_login[^ ]' /var/log/exim_mainlog

That works fine to find entries that contain content like this:

P=esmtpa S=1573 id=f1cd08396,...

But what I need to do is to change my grep statement, so that it finds single word logins that do not use the @ sign, like so:

 P=esmtpa A=courier_login:name S=1573 id=f1cd08396,...

Where the log in before was "", but in the second log entry, the log in used was only "name".

Is this possible using grep or egrep, perhaps in some kind of a compound statement?

Thanks much.

share|improve this question

The extended regular expression _login[^ ][^@]+\s should do it.

That is the literal string _login followed by a character which is not a space, followed by at least one character which is not @, followed by a whitespace character.

share|improve this answer
Thanks but it does not seem to work that way. I just tried this --- egrep '_login[^ ][^@]+\s' /var/log/exim_mainlog --- and I get all the log entries with instead of just user. – jols Jun 27 '13 at 23:23
Works for me. Try with a space instead of the \s - Maybe your grep interprets it differently. – l0b0 Jun 28 '13 at 8:08

If you would like to extract only the login names that do not contain the @ character, the following sed command might come handy:

echo -e "P=esmtpa S=1573 id=f1cd08396,...\nP=esmtpa A=courier_login:name2 S=1573 id=f1cd08396,..." | \
sed -nr 's/^.*_login:([^ @]+) .*$/\1/p'

Running this script will result in the output below:


Some explanation:

  • The first line just echoes 2 lines of example data (separated by a newline \n character).

  • The second line contains the sed -nr command, that in this case uses the s/regexp/replacement/p syntax. It (s) searches the line for a matching regexp regular expression (-r). If a portion of the line is matched, the replacement will be used to replace the matching portion. The -n switch and p command are only required to omit lines that are not matching the regexp.

  • sed locates the string "_login:" in a line. At that position:

    • The opening bracket marks the start of a sub-expression. (Consider it a region of the line.)
    • The [^ @]+ matches one more character that is neither a space nor @. It will expand until a space character is found.
    • The closing bracket marks the end of the sub-expression just before this character. The matched region is stored in a variable called \1.
  • If you take a look at the regexp part it basically follows the ^.*something.*$ pattern. The ^.* matches any characters at the beginning of the line until the expression something. Similarly the .*$ matches any characters at the end of line after the expression something. Matching the whole line with the regexp is important, because the whole matched portion is replaced.
  • The replacement part only contains the \1 variable, thus the matched login name will be substituted.
share|improve this answer
Thanks but I am not interested in extracting only the names, but rather we need to know who is logging into the email services, NOT using the full user ID which includes the @ sign. – jols Jun 27 '13 at 23:31
Well I believed that you look for both. Actually it only makes a one character difference, but edited the answer a bit for legibility. – lgarzo Jun 28 '13 at 6:38

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.