#!/usr/local/bin/perl

# to see the frequency of vpopmail users popping their mail
#
# tail -f /var/log/syslog | checkpop.pl
#

use strict;
use Time::Local;

my %mon = (Jan => 0, Feb => 1, Mar => 2, Apr => 3, May => 4, Jun => 5, Jul => 6,
           Aug => 7, Sep => 8, Oct => 9, Nov => 10, Dec => 11);

my $year = (localtime())[5]; # assume this year

my %hash;
while(<STDIN>){
   chop;
   if(/^(\S+)\s+(\d+)\s+(\d{2}):(\d{2}):(\d{2})\s.+vchkpw-pop3.+\s(\S+\@\S+):(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})$/){
      my ($month,$day,$hour,$min,$sec,$email,$ip) = ($1,$2,$3,$4,$5,$6,$7);
		my $epoch = timegm($sec,$min,$hour,$day,$mon{$month},$year);
		if(exists($hash{$email})){
			my $diff = ($epoch - $hash{$email});
			if($diff < 90){
				warn "$month $day $hour:$min:$sec -> $email:$ip ($diff second interim)\n";
			}
		}
		$hash{$email} = $epoch;
   }
}