how to grep messages of user test of a specific date

[needee]

MTA: POSTFIX

# tail -f /var/log/mail |grep "test"
Jul 3 12:16:02 tiger postfix/local[6981]: 036A23178E: to=<test@tiger>, orig_to=<test>, relay=local, delay=1, status=sent (delivered to mailbox)
.
.
shows all the messages related to user "test",
but I need to ADD another condition..the "date", i.e I need to grep messages of user test *but only of the specific date*
I did the following
# tail -f /var/log/mail |grep "test" |grep "Jul 2"

no results ;(

need to redirect messages related to user test on June 29 on a separate file.. following also doesn't works.
grep test /var/log/mail |grep "Jun 29" >/logs/test_mail_on_JUN29.txt
or
grep test /var/log/mail |grep "Jun 29" - >/logs/test_mail_on_JUN29.txt
;(
help

[vsemaska]

MTA: POSTFIX

# tail -f /var/log/mail |grep "test"
Jul 3 12:16:02 tiger postfix/local[6981]: 036A23178E: to=<test@tiger>, orig_to=<test>, relay=local, delay=1, status=sent (delivered to mailbox)
.
.
shows all the messages related to user "test",
but I need to ADD another condition..the "date", i.e I need to grep messages of user test *but only of the specific date*
I did the following
# tail -f /var/log/mail |grep "test" |grep "Jul 2"

no results ;(

The problem here is you're using tail's -f option which means loop forever outputing info as the file grows. You're also using tail's default of start by listing the last 10 lines. The 1st grep is waiting for tail so send more info before it has enough to send to the 2nd grep. Try using tail without the -f option.

Also, why use tail at all? Why not grep the whole file as you do in the following examples.

MTA: POSTFIX
need to redirect messages related to user test on June 29 on a separate file.. following also doesn't works.
grep test /var/log/mail |grep "Jun 29" >/logs/test_mail_on_JUN29.txt
or
grep test /var/log/mail |grep "Jun 29" - >/logs/test_mail_on_JUN29.txt
;(
help

Looks like both commands should work. What do you mean by doesn't work? Did you get an error message or did the .txt file get generated with nothing in it? If the latter then there were no lines with "Jun 29" in it. Does your mail file get rotated meaning the current one is renamed to something like mail.1 and a new one created? That would explain why older entries can't be found.

[needee]

Hi vsemaska, nice help.

The problem here is you're using tail's -f option which means loop forever outputing info as the file grows. You're also using tail's default of start by listing the last 10 lines. The 1st grep is waiting for tail so send more info before it has enough to send to the 2nd grep. Try using tail without the -f option.

yes you are right .. tail without "-f" works
i.e
# tail /var/log/mail |grep test |grep "Jul 8"

Also, why use tail at all? Why not grep the whole file as you do in the following examples.

hmm ...excellent .. nice point .. and I am stupid(seriously).

Looks like both commands should work. What do you mean by doesn't work? Did you get an error message or did the .txt file get generated with nothing in it? If the latter then there were no lines with "Jun 29" in it. Does your mail file get rotated meaning the current one is renamed to something like mail.1 and a new one created? That would explain why older entries can't be found.

didnt get the error message. just file remains empty.

But
following works fine
tail -f /var/log/mail |grep "test"

following doesnt works (no output on terminal/console)
tail -f /var/log/mail |grep "test" |grep "Jul 8"
i.e two spaces in b/w "Jul and 8".

neither following works
tail -f /var/log/mail |grep "test" |grep "Jul +8" (no output on terminal/console)

but following works
tail -f /var/log/mail |grep "test" |grep "Jul\ 8"
here two spaces after backslash(\), and before "8".

and following also works
# grep test /var/log/mail |grep "Jun\ 29" > mails.txt
here two spaces after backslash(\), and before "29".

i.e have to insert "<backslash><space><space>" in b/w month and date. e.g "month<backslash><space><space>date".

likewise following also works
# tail -f /var/log/mail |grep "test" |grep "Jul *8"
# grep test /var/log/mail |grep "Jul *8" >
mails.txt

i.e <month><space><*><date> works

Thanks n Regards.

[scm]

The pattern "<month><space><*><date>" works because it's matching the month followed by zero or more spaces (that's what the * after the space means) followed by the date. I'd be inclined to add a space after the date too, or you'll find that, eg. "Jul 2" will also match "Jul 20", "Jul 21", etc.

The backslash in the other example patterns is redundant, since you're telling grep to match a literal space (which it would anyway since the whole string is quoted) followed by a space.

[needee]

Thanks Dear scm