awk colorizer for tail.

One of the problems I have with tail -f maillog.txt | grep "search" is that I really did want to watch the noise and not just the signal. Except that I'd like to notice the signal. Here's my printcolor.awk Now I can use tail -f maillog.txt | awk -f printcolor.awk and see the whole tail, with keywords highlighted in *different* colors.

NOTE: ^[ is supposed to be Ctrl-v, Escape; NOT caret, left bracket.


function colorize(word, color)
{
c["red"] = "^[[1;31;40m"
c["green"] = "^[[1;32;40m"
c["yellow"] = "^[[1;33;40m"
c["blue"] = "^[[1;34;40m"
c["magenta"] = "^[[1;35;40m"
if (line ~ word)
{ split (line, a, word)
line=a[1] c[color] (word) "^[[0;37;40m" a[2]
}
}
{line = $0
colorize("whitelist","green")
colorize("Bayesian Spam","red")
print line
}



ETA: If you'd like to be annoyed/beeped at for something that you're looking for, you can add ctrl-v, ctrl-g in the right hand side, eg: "^G^[[1;32;40m" (not caret G)

ASSP and grep Part 2

I just used this monstrosity because I needed to get the email addresses of things that I knew whitelisted but I wanted to remove and populate the redlist.


grep "whitelist addition" maillog.txt | grep "my expression" | cut -d \> -f 1 | cut 33- > rlist


What does it do?

1. It finds all the "whitelist additions" in maillog.txt
   
2. For all of those, it searches for "my expression" to further limit what I'm searching
   
3. It then cuts the resulting line off at the > delimiter.
   
4. Then, it grabs the email address after position 33
   
5. and dumps it into rlist
   

I probably *should* have used awk to do this, but I didn't have it, and this is the ugly way to get the email list that I wanted. Arguably, I could have used cut -d \< -f 2 instead of the cut 33- but there you have it.

Edited to add: actually, the latter option is better/more flexible. I'd suggest that in the future.

Further edited to add:
grep "whitelist addition" maillog.txt | grep -v "localdomain.com"
This shows me all whitelists that my server made that were based upon bounces (contact-forwards, usually), not from true outbound from local users.