This Python script can be used for parsing exim mail logs to find messages that are over a certain filesize. In this case we were looking for senders of messages over 10MB (10000000 bytes). You can change that in the second to last line of the script.

example usage: cat /var/log/exim_mainlog | grep domain.com | msgsizefilter.py

Here it is:


#!/usr/bin/env python

import sys
for line in sys.stdin.readlines():
if line.find("S=") != -1:
s = int(line.split("S=")[1].split(" ")[0])
d = " ".join( line.split(" ")[0:2])
e = line.split(" <= ")[1].split(" ")[0]
if s > 10000000:
print “%s \t %d \t (%s)” % (d, s, e)