How do I find all the scripts that have mail sitting in my postfix mail queue? This server is sending out spam and I've spot checked it, but I want to make sure I haven't missed any scripts that may be included. PHP is configured to place the X-PHP-Originating-Script header in each email. If I can iterate over each email to find all those headers I should be able to find all relevant scripts.
This oneliner gathers the mailq output (I often pipe that to a file and then run the script against the file so I can tweak it with less performance impact). Then it cuts out only the mail ID first by using the cut command to identify the proper field and then using egrep to clean that up (removing empty lines, irrelevant IDs ending in * and lines starting with a ( or -. xargs puts each ID into postcat to output the contents including headers. Then we look for the header, sort them so the uniq command works properly and find just one instance of each script with uniq.
mailq |cut -f 1 -d " "|egrep -v "^\(|^$|^-|\*" |xargs postcat -q |grep "X-PHP-Originating-Script"|sort|uniq