class Parser def initialize(file) @file = File.open(file) @domains = Hash.new end def analyze @file.each do |line| parts = line.split(/ /) message_id = parts[7] start_time = parts[8] end_time = parts[9] service = parts[10] case service when "RECV": info = Hash["Sender" => parts[11], "Recipient" => parts[12], "Action" => parts[13], "ReasonExtra" => parts[14]] when "SCAN": info = Hash["Encrypted" => parts[11], "Sender" => parts[12], "Recipient" => parts[13], "Score" => parts[14], "Action" => parts[15], "Reason" => parts[16], "ReasonExtra" => parts[17], "Subject" => parts[18]] when "SEND" info = Hash["Recipient" => "no@recipient.com", "Encrypted" => parts[11], "Action" => parts[12], "QueueID" => parts[13], "Response" => parts[14]] else info = Hash["Recipient" => "no@recipient.com"] end if !info["Recipient"].nil? recip_parts = info["Recipient"].split(/@/) domain = recip_parts[1] username = recip_parts[0] if @domains.has_key? domain if @domains[domain].has_key? username #puts "adding one" @domains[domain][username]+=1 else #puts "Creating" @domains[domain][username] = 1 end else #puts "creating domain" @domains[domain] = Hash[username => 1] end else puts line return end end end def output @domains.each_pair { |domain,value| if !domain.nil? puts "#{domain}:#{domain.size}\n" value.each_pair { |email,num_emails| puts "#{email}: #{num_emails}" } puts "\n\n" end } end end barracuda_parser = Parser.new('barracuda.log') barracuda_parser.analyze barracuda_parser.output =========================== =========================== cugroup.com:11 cwb_sfj: 1 pgwc.gov.za:11 Bmachelm: 1 nextgenerationnow.com:21 sales: 3 jtoutant: 1 RetailFixture.com:17 RDeSalvo: 1 calmpjthealth.com:17 jjohnson: 2 kvesel: 42 jprice: 13 sogungbe: 1 svakos: 299 mgesner: 15 MGesner: 3 pebblier: 1 avesel: 1 rogansshoes.com:15 rogansshoes.comonline: 1 daverogan: 5 online: 6 tomrogand: 3 listonlinei: 2 johndavis: 9 patwolfnn: 1 eileenstrini: 1 patwolfn: 1 patwolf: 12 markrogan: 6 tomrogandd: 3 cheerandpom: 3 wolfonline: 6 tomrogan: 9 karlhanke: 4 dc: 2 donaldson: 7 fleetship.com:13 ish: 1 sgolaw.com:10 emery: 1