My machine is using CentOS 7.1. I'm trying to search through all the files within /var/spool/postfix.

The way I'm trying to achieve this is with:

$ egrep -lir --include="*.*" "somemail@somedomain.com" ./ > /root/results.txt

However, that search always comes back empty (results.txt is created, but there's nothing inside). Thinking that there might be a problem with @, or the --include, I've reduced the search to:

$ egrep -lir "somedomain.com" ./ > /root/results.txt

But that gives no results as well. I'm positive that there's at least ONE file with the string I'm looking for, so there should be at least one result within the *.txt.

How can I find the files containing the desired string, by using egrep? If that's not possible, any other searching method is welcome.

Why I need this / Background

Due to poor choice of email account and password, the machine was used to send around 500k spam messages, which started bouncing back pretty quickly, filling up the HDD. The offensive email account was deleted, the machine taken offline, and now I'm trying to hunt down a specific email message, among all those in /var/spool/postfix/defer and /var/spool/postfix/deferred.

I gues I could use a variant of mailq > /root/results.txt, but I'd like to do it with egrep, grep, find or any other command which returns already filtered results.

  • mailq|grep mail@domain maybe? or grep -r mail@domain * maybe? – stoney Jul 19 '18 at 13:01

The GNU grep can do the regular expression searches using the -E switch, so there's no need to use egrep.

I'd do the following:

$ grep -rilE 'somemail@somedomain.com' . | tee /root/results.txt

You can change out the | tee with a > if you don't want to see the results via the terminal.


  • What's the practical difference between this suggestion and the OP's own egrep -lir "somedomain.com" ./? – roaima Jul 19 '18 at 23:18
  • @roaima - this uses -E and uses single ticks, the OP had double. – slm Jul 20 '18 at 0:06

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.