This should be self-explanatory, allowing that TEMPFAIL is a greylist flag: [root@mail log]# for i in `ls maillog*gz`; do echo -n "$i: "; num=`gzcat $i | grep -c TEMPFAIL`; echo $num; totnum=$(($totnum+$num)); done; echo $totnum maillog.0.gz: 126907 maillog.1.gz: 137915 maillog.10.gz: 110875 maillog.11.gz: 162012 maillog.12.gz: 141682 maillog.13.gz: 137504 maillog.14.gz: 185007 maillog.15.gz: 167037 maillog.16.g This should be self-explanatory, allowing that TEMPFAIL is a greylist flag: [root@mail log]# for i in `ls maillog*gz`; do echo -n "$i: "; num=`gzcat $i | grep -c TEMPFAIL`; echo $num; totnum=$(($totnum+$num)); done; echo $totnum maillog.0.gz: 126907 maillog.1.gz: 137915 maillog.10.gz: 110875 maillog.11.gz: 162012 maillog.12.gz: 141682 maillog.13.gz: 137504 maillog.14.gz: 185007 maillog.15.gz: 167037 maillog.16.gz: 140281 maillog.17.gz: 160331 maillog.18.gz: 123243 maillog.19.gz: 158751 maillog.2.gz: 176522 maillog.20.gz: 157648 maillog.21.gz: 153283 maillog.3.gz: 169739 maillog.4.gz: 271368 maillog.5.gz: 163032 maillog.6.gz: 171642 maillog.7.gz: 150581 maillog.8.gz: 146269 maillog.9.gz: 156355 3467984 [root@mail log]# totnum=0; for i in `ls maillog*gz`; do echo -n "$i: "; num=`gzcat $i | grep -c Sent`; echo $num; totnum=$(($totnum+$num)); done; echo $totnum maillog.0.gz: 2296 maillog.1.gz: 2231 maillog.10.gz: 2168 maillog.11.gz: 1465 maillog.12.gz: 1442 maillog.13.gz: 1931 maillog.14.gz: 2456 maillog.15.gz: 2187 maillog.16.gz: 2240 maillog.17.gz: 2165 maillog.18.gz: 1545 maillog.19.gz: 1575 maillog.2.gz: 2280 maillog.20.gz: 2137 maillog.21.gz: 2273 maillog.3.gz: 2311 maillog.4.gz: 1338 maillog.5.gz: 1287 maillog.6.gz: 1979 maillog.7.gz: 2085 maillog.8.gz: 2372 maillog.9.gz: 2322 44085 [root@mail log]# This next snippet is counting the number of ipfw lines that block inbound TCP/25 from hosts flagged by my custom greylist/autoshun code: [root@mail log]# ipfw list | grep -c ^26000 10286 [root@mail log]# I don’t know whether to be giddy or depressed.