11

I have a mailq which is getting backed up with multiple emails with the same subject line. I would like to delete all emails in the mailq that match a particular subject line so they don't get sent. Any ideas how to do this? Pretty urgent as its spam related.

David
  • 829
  • 3
  • 13
  • 30

5 Answers5

20

With a typical postfix installation the email will be in /var/spool/postfix. There are several queues. You want to stop postfix so that you can safely use postsuper to remove the emails. This short script will remove all the emails that match a particular string. In our case we needed to find thousands of emails that all had the same subject line.

In this case, the emails were all deferred, because our remailing service had rejected them due to our being over the limit.

cd /var/spool/postfix/deferred
grep -r -i -l "This was the subject line" ./ | cut -d/ -f3 | postsuper -d -

Some key notes on this:

  • grep -l returned the filename for matches, which is the queueid of the matched message
  • the messages were all in different subdirs so the cut was to strip the path off the front. Make sure you test your return path to insure you're just getting the queue name
  • postsuper -d - tells postsuper to delete messages it got from stdin.

Hope this helps people who find this and are looking for more specific instructions.

gview
  • 1,025
  • 1
  • 10
  • 16
  • Unfortunately, this approach does not work for Unicode subject lines (means, those using [encoded-word](http://en.wikipedia.org/wiki/MIME#Encoded-Word) tokens as per [RFC2047](http://www.faqs.org/rfcs/rfc2047.html)). But even grep-ing through `postcat` output does not work in these cases. – tanius Sep 14 '14 at 21:26
  • Just a reminder - if you're using multiple configurations, then you'll need to add the config location to the postsuper command with the -c option – Andy Beverley Dec 06 '17 at 19:56
2

Postfix does not have a utility like exigrep, so you will need to grep the queue files for the subject and then pipe the queue id to postsuper to delete them

topdog
  • 3,490
  • 16
  • 13
2

Just an alternative command to do the same proposed by gview:

find /var/spool/postfix/deferred/ -exec grep -l 'Subject: this was the subject line' {} \; | xargs -r -n1 basename | xargs -r -n1 postsuper -d
  • find + grep -l: find the deferred emails on file system with the given subject
  • xargs + basename: retrieve the message ID from the path of the mail file
  • xargs + postsuper: use the retrieved message ID to feed postsuper -d and delete the mail from the queue
lgaggini
  • 571
  • 3
  • 8
1

Nowadays, postqueue can output structured json with -j.

You can extract required info using simple grep or a json parser in your favorite language.

eg extract queue id and email with sed:

postqueue -j | sed -rn 's/.*"queue_id": "([^"]*)".*"address": "([^"]*)".*/\1\t\2/gp'

you can continue it like:

| egrep "spammer.com|@otherspammer.org|rejectme@any.*com" | cut -f 1 | postsuper -d -

egrep to filter desired addresses, cut to get the first field, and postsuper -d - to remove all queue ID's received from the pipe. You can create an alias for a lightweight solution or of course use python / perl / whatever to build your sophisticated solution.

goteguru
  • 302
  • 1
  • 12
-1

You can use:

postqueue -p | grep 'user@example.com' | cut -d ' ' -f1 | tr -d '*' | postsuper -d -
HBruijn
  • 72,524
  • 21
  • 127
  • 192
Jorge Petry
  • 1
  • 1
    Welcome to Server Fault! It looks like you may have the knowledge to provide good Answer here, but please consider reading [How do I write a good Answer?](http://serverfault.com/help/how-to-answer) in our help center and then revise the Answer. Your Commands/Code/Settings may technically be the solution but some explanation and context is welcome. Thanks in advance. – HBruijn Dec 07 '17 at 15:59
  • You're right, but explaining how your pipeline works would benefit a lot more future searchers. Consider using Edit to grow your answer please. – Criggie Dec 08 '17 at 10:22