It is sometimes useful to be able to search all email stored on the server for keywords. Examples include: wanting to compile a list of all email interactions with a client, or regarding a specific project, and the specific employees may no longer be with the company.
If you are using IMAP accounts instead of POP, all email is stored on the server, so searching all mailboxes concurrently is possible. Unfortunately, Apple does not provide tools to make this easy.
Searching IMAP store on MacOSX.4 (Tiger) and OSX.5 (Leopard) server
MacOSX.4 (Tiger) and OSX.5 (Leopard) server use Cyrus to store IMAP email. Cyrus uses its own internal databases to keep track of mailbox names, messages attributes such as whether the email has been read, who may access mail, etc.
Fortunately, Cyrus uses the file system to store the actual email message in RFC 822 format, which is is text-based, so we can search the files using ordinary file search commands such as grep.
You can perform the search directly on the active mail server user files (located by default in OSX server at /var/spool/imap/user), or you can perform this search on your mailbfr backup copy (located at /mail_backup/mailbackup/cyrus_partitions_DIRS/default/user). (You are backing up your mail server using mailbfr right?!!).
In the user directory are directories for every mailbox, so we'll be using this path for the search. In each directory are numbered files ending with a period (ie 52., 54., etc). One of these files exists for each message.
> cd /path/to/imap/user/directory/to/search
> grep -R --exclude=cyrus.cache your-keyword .
- -R : performs a recursive search into all subdirectories below the current directory
- --exclude=cyrus.cache : excludes all cyrus cache files (which we are not interested in)
- your-keyword : whatever you are looking for. This can be a regular expression, see man pages for grep.
- . : starts the search at the current directory
For example, if we want to search the entire IMAP mail store for "eagle":
> grep -R --exclude=cyrus.cache eagle .we might see the following results:
./hr-clerk1/active applications/169.:Z2ZmIocXFRUFWWv9bAsyq2vNrRTMrbKdQ9M27eM4duwYch4WixW4eaglent7gyEBpEEHaJ86CTA8./hr-clerk1/active applications/28.:Z2ZmIocXFRUFWWv9bAsyq2vNrRTMrbKdQ9M27eM4duwYch4WixW4eaglent7gyEBpEEHaJ86CTA8
./office-manager/aPending/Staffing/Comm^ Coord^/Screen/60.: name=Christinaeagleres.doc
./user29/42.: "Eagle, Lynn C" <This email address is being protected from spambots. You need JavaScript enabled to view it.>
./user29/Sent Messages/18.:To: This email address is being protected from spambots. You need JavaScript enabled to view it.
./info/1096.: This email address is being protected from spambots. You need JavaScript enabled to view it.
./info/1096.:Final-Recipient: rfc822;This email address is being protected from spambots. You need JavaScript enabled to view it.
./info/1096.:To: "Replica Purses" <This email address is being protected from spambots. You need JavaScript enabled to view it.>
./jr-clerk2/Hotels/Inquiries/14419.:eagle mill rd</p><p>City: lula</p><p>State /
You can then review each file to see if it contains the content of interest.
References:
Cyrus IMAP Server: Cyrus Internals
Searching IMAP store on MacOSX.6 (Snow Leopard) server
MacOSX.6 (Snow Leopard) server uses Dovecot to store IMAP email. This article needs to be expanded to provide instructions for searching Dovecot email (sorry).