Using m4 to create regular expressions for egrep via logcheck.

This is a cryptographically signed message in MIME format.

--------------ms080204040406080404070207
Content-Type: text/plain; charset=utf-8; format=flowed
Content-Language: en-US
Content-Transfer-Encoding: quoted-printable

Hi,

I did something with m4 today that I think was a LOT easier to do with=20
m4 than without.  I figured I'd share it with the list.

    --8<--
    divert(`-1')
    define(`DAEMONPID', `$1\[DIGITS\]:')
    define(`DATE', `\w{3} [ :[:digit:]]{11}')
    define(`DIGIT', `[[:digit:]]')
    define(`DIGITS', `DIGIT+')
    define(`HOST', `[._[:alnum:]-]+')
    define(`HOSTIP', `HOST\[IP\]')
    define(`IP', `[.:[:xdigit:]]+')
    define(`VERB', `( $1=3DDIGITS`'(/DIGITS)?)?')
    divert`'dnl
    ^DATE HOST DAEMONPID(`postfix(/smtps)?/smtpd') disconnect from=20
=20
HOSTIP`'VERB(`helo')VERB(`ehlo')VERB(`starttls')VERB(`auth')VERB(`mail')V=
ERB(`rcpt')VERB(`data')VERB(`bdat')VERB(`rset')VERB(`noop')VERB(`quit')VE=
RB(`unknown')VERB(`commands')$
    -->8--

That produces the following regular expression.

    --8<--
    ^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+=20
postfix(/smtps)?/smtpd\[[[:digit:]]+\]: disconnect from=20
[._[:alnum:]-]+\[[.:[:xdigit:]]+\]( helo=3D[[:digit:]]+(/[[:digit:]]+)?)?=
(=20
ehlo=3D[[:digit:]]+(/[[:digit:]]+)?)?(=20
starttls=3D[[:digit:]]+(/[[:digit:]]+)?)?(=20
auth=3D[[:digit:]]+(/[[:digit:]]+)?)?(=20
mail=3D[[:digit:]]+(/[[:digit:]]+)?)?(=20
rcpt=3D[[:digit:]]+(/[[:digit:]]+)?)?(=20
data=3D[[:digit:]]+(/[[:digit:]]+)?)?(=20
bdat=3D[[:digit:]]+(/[[:digit:]]+)?)?(=20
rset=3D[[:digit:]]+(/[[:digit:]]+)?)?(=20
noop=3D[[:digit:]]+(/[[:digit:]]+)?)?(=20
quit=3D[[:digit:]]+(/[[:digit:]]+)?)?(=20
unknown=3D[[:digit:]]+(/[[:digit:]]+)?)?(=20
commands=3D[[:digit:]]+(/[[:digit:]]+)?)?$
    -->8--

Backstory:  I'm working with logcheck which basically uses egrep regular =

expressions to filter out log entries that are okay and email those that =

aren't filtered out to an administrator.

There are 13 different parameters for verbs that can each take three=20
states; not used, used in the sort form, or used in the long form.  Plus =

there's another optional component if TLS is used.  The number of=20
permutations and organically growing the list as they are seen was=20
getting really annoying.

So, I spent the 10-15 minutes to create and file the rough edges off of=20
the m4 and I got a working regular expression without breaking my brain. =

  :-)

I figure that there are other people who might be interested in=20
processing Postfix log messages and seeing as there hadn't been anything =

from the list in a few days, well here we go.  :-)



--=20
Grant. . . .
unix || die


--------------ms080204040406080404070207
Content-Type: application/pkcs7-signature; name="smime.p7s"
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename="smime.p7s"
Content-Description: S/MIME Cryptographic Signature

MIAGCSqGSIb3DQEHAqCAMIACAQExDzANBglghkgBZQMEAgEFADCABgkqhkiG9w0BBwEAAKCC
CzowggUiMIIECqADAgECAhEAw8IZWQHDVuWWKHZeojBgoDANBgkqhkiG9w0BAQsFADCBljEL
MAkGA1UEBhMCR0IxGzAZBgNVBAgTEkdyZWF0ZXIgTWFuY2hlc3RlcjEQMA4GA1UEBxMHU2Fs
Zm9yZDEYMBYGA1UEChMPU2VjdGlnbyBMaW1pdGVkMT4wPAYDVQQDEzVTZWN0aWdvIFJTQSBD
bGllbnQgQXV0aGVudGljYXRpb24gYW5kIFNlY3VyZSBFbWFpbCBDQTAeFw0yMjExMTQwMDAw
MDBaFw0yMzExMTQyMzU5NTlaMCsxKTAnBgkqhkiG9w0BCQEWGmd0YXlsb3JAdG5ldGNvbnN1
bHRpbmcubmV0MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAzOnBjTJUlBTzN81c
PlYErJc9kEbTI/hXq0NA6ZoG4VM6puYTEXtITANjgX+NRwwHjldESnC8dvh6Mx5ckEk9sWoD
l8Yr/dWhF3s4fGxAX5ziOeuBI/yX7rKJn6DOwclV3C6dyt3zrLB6LOiF4gA+lk/o3EbOwoPh
pW2MqAywy18OIvzfmEXKdya8E/uIP4v/8AHmtakxHfmZ33Krbwh2oia69esRKc7q2i3Jh+ar
Tf3PuZJETd86Sb0Lz1+3zAXcYko2/3G9O9AwtUSDvkx5IUKieG8R4a8HLwuUTBNIsJ0qOdmv
4hUjc3IsP0jN+xebTE4w7PheolE/OStiFshpKQIDAQABo4IB0zCCAc8wHwYDVR0jBBgwFoAU
CcDy/AvalNtf/ivfqJlCz8ngrQAwHQYDVR0OBBYEFPUkNRFsHVlNMgaz3G4kfNa8DU4VMA4G
A1UdDwEB/wQEAwIFoDAMBgNVHRMBAf8EAjAAMB0GA1UdJQQWMBQGCCsGAQUFBwMEBggrBgEF
BQcDAjBABgNVHSAEOTA3MDUGDCsGAQQBsjEBAgEBATAlMCMGCCsGAQUFBwIBFhdodHRwczov
L3NlY3RpZ28uY29tL0NQUzBaBgNVHR8EUzBRME+gTaBLhklodHRwOi8vY3JsLnNlY3RpZ28u
Y29tL1NlY3RpZ29SU0FDbGllbnRBdXRoZW50aWNhdGlvbmFuZFNlY3VyZUVtYWlsQ0EuY3Js
MIGKBggrBgEFBQcBAQR+MHwwVQYIKwYBBQUHMAKGSWh0dHA6Ly9jcnQuc2VjdGlnby5jb20v
U2VjdGlnb1JTQUNsaWVudEF1dGhlbnRpY2F0aW9uYW5kU2VjdXJlRW1haWxDQS5jcnQwIwYI
KwYBBQUHMAGGF2h0dHA6Ly9vY3NwLnNlY3RpZ28uY29tMCUGA1UdEQQeMByBGmd0YXlsb3JA
dG5ldGNvbnN1bHRpbmcubmV0MA0GCSqGSIb3DQEBCwUAA4IBAQBdVEYkwnfj7/0fx6R9ll/7
F1HeOL+Q/gzdd4bKpaY3/dkCyHVtx2dAMixzM4YGIq4rDsbhPK1MXqQAS89B786rG9XjWKgM
VlgiBHir/9eQxhvX4AbQx1eJdCXNKTMJJwyIG2qlvuor/8H8//ZIjJuBgYAzW4TZREolhzVP
4g92+De1zyWW+3bESGHgx1E1+tkdvYeQATt7wkUtsEkn05MUHGAfRWt0tE3C321ajqSuFtxC
VCeGvGusV8+3rw2vsqVG/mkTsmn1EAtq0jGhVgwIgQO8soFSRt/3zWibnVk1aRrXvy45WMGv
an16R0/HQp8oLG3MYq++Vq6CFBbIG+9OMIIGEDCCA/igAwIBAgIQTZQsENQ74JQJxYEtOisG
TzANBgkqhkiG9w0BAQwFADCBiDELMAkGA1UEBhMCVVMxEzARBgNVBAgTCk5ldyBKZXJzZXkx
FDASBgNVBAcTC0plcnNleSBDaXR5MR4wHAYDVQQKExVUaGUgVVNFUlRSVVNUIE5ldHdvcmsx
LjAsBgNVBAMTJVVTRVJUcnVzdCBSU0EgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkwHhcNMTgx
MTAyMDAwMDAwWhcNMzAxMjMxMjM1OTU5WjCBljELMAkGA1UEBhMCR0IxGzAZBgNVBAgTEkdy
ZWF0ZXIgTWFuY2hlc3RlcjEQMA4GA1UEBxMHU2FsZm9yZDEYMBYGA1UEChMPU2VjdGlnbyBM
aW1pdGVkMT4wPAYDVQQDEzVTZWN0aWdvIFJTQSBDbGllbnQgQXV0aGVudGljYXRpb24gYW5k
IFNlY3VyZSBFbWFpbCBDQTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAMo87ZQK
Qf/e+Ua56NY75tqSvysQTqoavIK9viYcKSoq0s2cUIE/bZQu85eoZ9X140qOTKl1HyLTJbaz
Gl6nBEibivHbSuejQkq6uIgymiqvTcTlxZql19szfBxxo0Nm9l79L9S+TZNTEDygNfcXlkHK
RhBhVFHdJDfqB6Mfi/Wlda43zYgo92yZOpCWjj2mz4tudN55/yE1+XvFnz5xsOFbme/SoY9W
Aa39uJORHtbC0x7C7aYivToxuIkEQXaumf05Vcf4RgHs+Yd+mwSTManRy6XcCFJE6k/LHt3n
dD3sA3If/JBz6OX2ZebtQdHnKav7Azf+bAhudg7PkFOTuRMCAwEAAaOCAWQwggFgMB8GA1Ud
IwQYMBaAFFN5v1qqK0rPVIDh2JvAnfKyA2bLMB0GA1UdDgQWBBQJwPL8C9qU21/+K9+omULP
yeCtADAOBgNVHQ8BAf8EBAMCAYYwEgYDVR0TAQH/BAgwBgEB/wIBADAdBgNVHSUEFjAUBggr
BgEFBQcDAgYIKwYBBQUHAwQwEQYDVR0gBAowCDAGBgRVHSAAMFAGA1UdHwRJMEcwRaBDoEGG
P2h0dHA6Ly9jcmwudXNlcnRydXN0LmNvbS9VU0VSVHJ1c3RSU0FDZXJ0aWZpY2F0aW9uQXV0
aG9yaXR5LmNybDB2BggrBgEFBQcBAQRqMGgwPwYIKwYBBQUHMAKGM2h0dHA6Ly9jcnQudXNl
cnRydXN0LmNvbS9VU0VSVHJ1c3RSU0FBZGRUcnVzdENBLmNydDAlBggrBgEFBQcwAYYZaHR0
cDovL29jc3AudXNlcnRydXN0LmNvbTANBgkqhkiG9w0BAQwFAAOCAgEAQUR1AKs5whX13o6V
bTJxaIwA3RfXehwQOJDI47G9FzGR87bjgrShfsbMIYdhqpFuSUKzPM1ZVPgNlT+9istp5UQN
RsJiD4KLu+E2f102qxxvM3TEoGg65FWM89YN5yFTvSB5PelcLGnCLwRfCX6iLPvGlh9j30lK
zcT+mLO1NLGWMeK1w+vnKhav2VuQVHwpTf64ZNnXUF8p+5JJpGtkUG/XfdJ5jR3YCq8H0OPZ
kNoVkDQ5CSSF8Co2AOlVEf32VBXglIrHQ3v9AAS0yPo4Xl1FdXqGFe5TcDQSqXh3TbjugGnG
+d9yZX3lB8bwc/Tn2FlIl7tPbDAL4jNdUNA7jGee+tAnTtlZ6bFz+CsWmCIb6j6lDFqkXVsp
+3KyLTZGXq6F2nnBtN4t5jO3ZIj2gpIKHAYNBAWLG2Q2fG7Bt2tPC8BLC9WIM90gbMhAmtMG
quITn/2fORdsNmaV3z/sPKuIn8DvdEhmWVfh0fyYeqxGlTw0RfwhBlakdYYrkDmdWC+XszE1
9GUi8K8plBNKcIvyg2omAdebrMIHiAHAOiczxX/aS5ABRVrNUDcjfvp4hYbDOO6qHcfzy/uY
0fO5ssebmHQREJJA3PpSgdVnLernF6pthJrGkNDPeUI05svqw1o5A2HcNzLOpklhNwZ+4uWY
LcAi14ACHuVvJsmzNicxggQ1MIIEMQIBATCBrDCBljELMAkGA1UEBhMCR0IxGzAZBgNVBAgT
EkdyZWF0ZXIgTWFuY2hlc3RlcjEQMA4GA1UEBxMHU2FsZm9yZDEYMBYGA1UEChMPU2VjdGln
byBMaW1pdGVkMT4wPAYDVQQDEzVTZWN0aWdvIFJTQSBDbGllbnQgQXV0aGVudGljYXRpb24g
YW5kIFNlY3VyZSBFbWFpbCBDQQIRAMPCGVkBw1bllih2XqIwYKAwDQYJYIZIAWUDBAIBBQCg
ggJZMBgGCSqGSIb3DQEJAzELBgkqhkiG9w0BBwEwHAYJKoZIhvcNAQkFMQ8XDTIzMDIxNzA2
MDYxOFowLwYJKoZIhvcNAQkEMSIEIMlWWKYbPn2gf4JlSKEdPcscyt4Dis/xnC1uimmZpqeb
MGwGCSqGSIb3DQEJDzFfMF0wCwYJYIZIAWUDBAEqMAsGCWCGSAFlAwQBAjAKBggqhkiG9w0D
BzAOBggqhkiG9w0DAgICAIAwDQYIKoZIhvcNAwICAUAwBwYFKw4DAgcwDQYIKoZIhvcNAwIC
ASgwgb0GCSsGAQQBgjcQBDGBrzCBrDCBljELMAkGA1UEBhMCR0IxGzAZBgNVBAgTEkdyZWF0
ZXIgTWFuY2hlc3RlcjEQMA4GA1UEBxMHU2FsZm9yZDEYMBYGA1UEChMPU2VjdGlnbyBMaW1p
dGVkMT4wPAYDVQQDEzVTZWN0aWdvIFJTQSBDbGllbnQgQXV0aGVudGljYXRpb24gYW5kIFNl
Y3VyZSBFbWFpbCBDQQIRAMPCGVkBw1bllih2XqIwYKAwgb8GCyqGSIb3DQEJEAILMYGvoIGs
MIGWMQswCQYDVQQGEwJHQjEbMBkGA1UECBMSR3JlYXRlciBNYW5jaGVzdGVyMRAwDgYDVQQH
EwdTYWxmb3JkMRgwFgYDVQQKEw9TZWN0aWdvIExpbWl0ZWQxPjA8BgNVBAMTNVNlY3RpZ28g
UlNBIENsaWVudCBBdXRoZW50aWNhdGlvbiBhbmQgU2VjdXJlIEVtYWlsIENBAhEAw8IZWQHD
VuWWKHZeojBgoDANBgkqhkiG9w0BAQEFAASCAQAle1SI0ijzSuHgr53xwcDwOn+wQlb9VlWg
dKZq2cUL9Tgrhe6Sj7wlQrEd/Gm/oDaBHswx0Kt4AH2lQlyTkIPMrDuYvAXihK8zKlc6oiqI
ZLueT7z30OFQGcKmCcrkzm4RxRrqbP1qljKqMvMx/1nNLN5if68PmAUJGoJ9JyIedMtQ2i4Z
Wq+0Lva9+CIeq1+zQlPSAmv2lByKvICQ2AiSk+OXBGdrNb2O9MjHiqhPQXsS4b+5RiZm8Bmi
Ub8UFSNyXnxOu1ShIHXVUjmycZIWlK6sXuzPNzka6su+aD5ypHR9SGy5Gr0JqED6rdKaJBYY
ul8HfEmXjlEoWpYWyizBAAAAAAAA
--------------ms080204040406080404070207--