Exim shell script to produce a report for Inode limit exceeded

[eugenevdm.host]

Any genius script writers out there? Or maybe referral to a website that can show me some shell script reports based on Exim?

Basically what I'm after is a script to collect mail RCPT information containing the following 'frozen' / undeliverable message:

cat /var/log/exim_mainlog | grep "Inode limit exceeded"

"2019-11-10 07:34:05 H=server2.server.net [1.2.3.4]:55977 X=TLSv1:ECDHE-RSA-AES256-SHA:256 CV=no F=<[email protected]> rejected RCPT <[email protected]>: Mailbox is full / Blocks limit exceeded / Inode limit exceeded"

I took over an email server and the client is getting this constantly because their email limits are incorrect. I've started a conversion to MDBOX but I need to in the short term identify all the users who are having this problem so that I can up their limits. On a small email server this would be trivial, but in my case I have 1000s of accounts and it's not proving trivial at all!

I've seen some pretty intense Exim scripts in the wild like the one below, which shows the user sending the most email:

head -1 /var/log/exim_mainlog | awk '{print $1}' ; egrep -o 'dovecot_login[^ ]+|dovecot_plain[^ ]+' /var/log/exim_mainlog | cut -f2 -d":" | sort|uniq -c|sort -nk 1 ; tail -1 /var/log/exim_mainlog | awk '{print From $1}'

Unfortunately my level of knowledge of awk and egrep and sort and uniq and tail and combining the lot is just not up to par to perform this query.

 

[cPanelLauren]

The following might do something similar to what you're asking for:

grep "Inode limit exceeded" /var/log/exim_mainlog |grep -Po '<\K[^>][email protected][^>]+(?=>)' |sort |uniq -c |sort -n

What should get output is the unique count, sorted numerically, and the email address