title: Awk parsing of unique IP addresses from maillog
body: <p>Yesterday I asked a question here about a <a href="https://stackoverflow.com/questions/4190275/oneliner-to-calculate-complete-size-of-all-messages-in-maillog">oneliner</a> and <a href="https://stackoverflow.com/users/288349/mjschultz">mjschultz</a> gave me an answer that I instantly fell in love with :) Awk just destroyed the task at hand, parsing a large logfile (500+ MB) in a matter of seconds. Now I'm trying to port my other oneliners to awk.</p>
  
  <p>This is the one in question:</p>
  
  <pre><code>grep "pop3\[" maillog | grep "User logged in" |  
  egrep -o '([[:digit:]]{1,3}\.){3}[[:digit:]]{1,3}' | sort -u
  </code></pre>
  
  <p>I need the list of all unique IP addresses using pop3 to connect to the mail server.</p>
  
  <p>This is an example log entry:</p>
  
  <pre><code>Nov 15 00:49:21 hostname pop3[19418]: login: [10.10.10.10] username plaintext  
  User logged in
  </code></pre>
  
  <p>So I find all the lines containing "pop3" and I parse them for the "User logged in" part. Next i use egrep and a regex to match IP addresses and I use sort to filter out the duplicate addresses.</p>
  
  <p>This is what I have so far for my awk version:</p>
  
  <pre><code>awk '/pop3\[.*.User logged in/ {ip[$7]=0} END {for (address in ip)  
  { print address} }' maillog
  </code></pre>
  
  <p>This works perfectly but as always not all log entries are identical, for example sometimes the IP gets moved to the 8th field like here:</p>
  
  <pre><code>Nov 15 10:42:40 hostname pop3[2232]: login: hostname.domain.com [20.20.20.20]  
  username plaintext User logged in
  </code></pre>
  
  <p>What would be the best way to catch those entries with awk as well?</p>
  
  <p>As always thanks for all the great responses in advance, you've taught me so much already :)</p>