#!/bin/bash

# Script to query all audit logs to see last MAPI SP version used
# to logon

# List all the audit files in timestamp order
for i in $(ls -rt ~scalix/logs/audit*)
do
  # Look for the "user-signon" block
  awk '/^user-signon/ {
                        # Get the timestamp
                        getline
                        logint=$3 " " $4 " " $5 " " $6
                        # Next linet is user-agent-id, is it Outlook
                        getline
                        if ( $2 == "Outlook" ) {
                          olv=$3
                          spv=$10
                          # Get down to the user record
                          getline
                          getline
                          getline
                          # Get the username up to any "/"
                          name=$3 " " $4
                          a=index(name,"/")
                          if (a != 0) name=substr(name,1,a-1)
                          getline
                          if ($1 != "delegate-user") {
                            # Print a formatted line
                            printf("%-20s %-15s %-15s %s\n", name, olv, spv, logint)
                          }
                        }
                      }
      ' $i
# Reverse the order of output, to get last logins first
# then sort the output uniquely based on only the name
done | awk '{s[NR]=$0}END{for(i=NR;i>0;i--){print s[i]}}' \
| sort -u -k 1,1 -k2,2