NAME

pmx-logsearch - PureMessage Log Search Utility


SYNOPSIS

    pmx-logsearch
    pmx-logsearch --to='support@sophos.com'
    pmx-logsearch --from='newsletter@sophos.com' --atime='2007-10-02'


OPTIONS

Search Options

--client|-c CLIENT
Restrict search to connecting client IP address or hostname.

--relay|-y RELAY
Restrict search to hostname or IP address of the connecting relay that delivered this message.

--to|-t RECIPIENT
Search for messages to RECIPIENT.

--from|-f SENDER
Search for messages from SENDER.

--offset|-o OFFSET
Return matching messages, skipping the first OFFSET items. This can be used to page through results:
  pmx-logsearch --atime=2007-08-20T10:50 -n 100

  pmx-logsearch --atime=2007-08-20T10:50 --offset=100

--atime|-a TIMESTAMP
Search for messages starting from the passed date. See TIMESTAMPS below for the accepted format.

--ztime|-z TIMESTAMP
Search for messages ending at the passed date. See TIMESTAMPS below for the accepted format.

--action ACTION
Search for messages by ACTION.

--reason REASON
Search for messages by REASON.

--msgid MSG_ID
Search for messages by mail message-id.

--route ROUTE
Search by any MTA the message has passed through.

Display Options

--count|-n NUM
Number of messages to return. Default is 10.

--sort|-s FIELD
Sort on FIELD, where field is one of:
  • to

  • from

  • action

  • subject

  • client

  • relay

--reverse|-r
Sort in reverse order.

--verbose|-v FETCHKEY
Show more message details. FETCHKEY is returned in the displayed results.

Miscellaneous Options

--help|-h
Print a brief help message and exit.

--man|-M
Print the manual page and exit.


DESCRIPTION

Forensic utility for searching for messages in the log files and tracing their delivery path.


TIMESTAMPS

Dates should be given in ISO8601 format. If an explicit timezone is not given it assumed to be localtime.

Examples:

2007-01-31T13:27:17 - No timezone info (assumes localtime)

2007-01-31T13:27:17Z - UTC time

2007-01-31T13:27:17+08 - Local time with UTC offset 2007-01-31T13:27:17+0830 2007-01-31T13:27:17-08 2007-01-31T13:27:17-0830

Note that the '-' and ':' characters are optional, e.g.

2007-01-31T13:27:17

could also be written as

20070131T132717


COPYRIGHT

Copyright (C) 2007 Sophos Plc. All right reserved. Sophos and PureMessage are trademarks of Sophos Plc.