-1

My machine is using CentOS 7.1. I'm trying to search through all the files within /var/spool/postfix.

The way I'm trying to achieve this is with:

$ egrep -lir --include="*.*" "somemail@somedomain.com" ./ > /root/results.txt

However, that search always comes back empty (results.txt is created, but there's nothing inside). Thinking that there might be a problem with @, or the --include, I've reduced the search to:

$ egrep -lir "somedomain.com" ./ > /root/results.txt

But that gives no results as well. I'm positive that there's at least ONE file with the string I'm looking for, so there should be at least one result within the *.txt.

How can I find the files containing the desired string, by using egrep? If that's not possible, any other searching method is welcome.

Why I need this / Background

Due to poor choice of email account and password, the machine was used to send around 500k spam messages, which started bouncing back pretty quickly, filling up the HDD. The offensive email account was deleted, the machine taken offline, and now I'm trying to hunt down a specific email message, among all those in /var/spool/postfix/defer and /var/spool/postfix/deferred.

I gues I could use a variant of mailq > /root/results.txt, but I'd like to do it with egrep, grep, find or any other command which returns already filtered results.

slm
  • 369,824
FiddlingAway
  • 133

1 Answers1

1

The GNU grep can do the regular expression searches using the -E switch, so there's no need to use egrep.

I'd do the following:

$ grep -rilE 'somemail@somedomain.com' . | tee /root/results.txt

You can change out the | tee with a > if you don't want to see the results via the terminal.

References

slm
  • 369,824