GREPMAIL(1)

NAME
grepmail - search mailboxes for mail matching a regular expression

SYNOPSIS
  grepmail [--help] [-abBDhHilmrRuv] [-s size] [-d <date-specification>]
    [-X <signature-pattern>] [-Y <header-pattern>] <files...>

  grepmail [--help] [-abBDhHilmrRuv] [-s size] [-d <date-specification>]
    [-X <signature-pattern>] [-Y <header-pattern>] [[-e] <pattern>] <files...>

  grepmail [--help] [-abBDhHilmrRuv] [-s size] [-d <date-specification>]
    [-X <signature-pattern>] [-Y <header-pattern>] [-E <expr>] <files...>

DESCRIPTION
    grepmail looks for mail messages containing a pattern, and prints the resulting messages on standard out.

    By default grepmail looks in both header and body for the specified pattern.

    When redirected to a file, the result is another mailbox, which can, in turn, be handled by standard User Agents, such as elm, or even used as input for another instance of grepmail.

    At least one of -E, -e, -d, -s, or -u must be specified. The pattern is optional if -d, -s, and/or -u is used. The -e flag is optional if there is no file whose name is the pattern. The -E option can be used to specify complex search expressions involving logical operators. (See below.)

    If a mailbox can not be found, grepmail searches the $home/mail, $home/Mail, $home/Mailbox directories (or the directory specified by the MAIL environment variable).

OPTIONS AND ARGUMENTS
Many of the options and arguments are analogous to those of grep.

pattern
    The pattern to search for in the mail message. May be any Perl regular expression, but should be quoted on the command line to protect against globbing (shell expansion). To search for more than one pattern, use the form "(pattern1|pattern2|...)".

mailbox
    Mailboxes must be traditional, UNIX "/bin/mail" mailbox format. The mailboxes may be compressed by gzip, tzip, or bzip2, in which case gunzip, tzip, or bzip2 must be installed on the system.

    If no mailbox is specified, takes input from stdin, which can be compressed or not. grepmail's behavior is undefined when ASCII and binary data is piped together as input.

-a  Use arrival date instead of sent date.

-b  Asserts that the pattern must match in the body of the email.

-D  Enable debug mode, which prints diagnostic messages.

-d  Date specifications must be of the form of:
      - a date like "today", "yesterday", "5/18/93", "5 days ago", "5 weeks ago",
      - OR "before", "after", or "since", followed by a date as defined above,
      - OR "between <date> and <date>", where <date> is defined as above.

    Simple date expressions will first be parsed by Date::Parse. If this fails, grepmail will attempt to parse the date with Date::Manip, if the module is installed on the system. Use an empty pattern (i.e. -d "") to find emails without a "Date: ..." line in the header.

-E  Specify a complex search expression using logical operators. The current syntax allows the user to specify search expressions using Perl syntax. Three values can be used: $email (the entire email message), $email_header (just the header), or $email_body (just the body). A search is specified in the form "$email =~ /pattern/", and multiple searches can be combined using "&&" and "||" for "and" and "or".

    For example, the expression

      $email_header =~ /^From: .*\@coppit.org/ && $email =~ /grepmail/i

    will find all emails which originate from coppit.org (you must escape the "@" sign with a backslash), and which contain the keyword "grepmail" anywhere in the message, in any capitalization.

    -E is incompatible with -b, -h, and -e. -i, -M, -S, and -Y have not yet been implemented.

    NOTE: The syntax of search expressions may change in the future. In particular, support for size, date, and other constraints may be added. The syntax may also be simplified in order to make expression formation easier to use (and perhaps at the expense of reduced functionality).

-e  Explicitly specify the search pattern. This is useful for specifying patterns that begin with "-", which would otherwise be interpreted as a flag.

-F  Force processing of ASCII files which don't appear to be mailboxes.

-h  Asserts that the pattern must match in the header of the email.

-H  Print the header but not body of matching emails.

-i  Make the search case-insensitive (by analogy to grep -i).

-l  Output the names of files having an email matching the expression, (by analogy to grep -l).

-M  Causes grepmail to ignore non-text MIME attachments. This removes false positives resulting from binaries encoded as ASCII attachments.

-m  Append "X-Mailfolder: <folder>" to all email headers, indicating which folder contained the matched email.

-n  Prefix each line with line number information. If multiple files are specified, the filename will precede the line number. NOTE: When used in conjunction with -m, the X-Mailfolder header has the same line number as the next (blank) line.

-q  Quiet mode. Suppress the output of warning messages about non-mailbox files, directories, etc.

-r  Generate a report of the names of the files containing emails matching the expression, along with a count of the number of matching emails.

-R  Causes grepmail to recurse any directories encountered.

-s  Return emails smaller than the size (in bytes) specified with this flag.

-S  Ignore signatures. The signature consists of everything after a line consisting of "-- ".

-u  Output only unique emails, by analogy to sort -u. Grepmail determines email uniqueness by the Message-ID header.

-v  Invert the sense of the search, by analogy to grep -v. This results in the set of emails printed being the complement of those that would be printed without the -v switch.

-X  Specify a regular expression for the signature separator. By default this pattern is '^-- $'.

-Y  Specify a pattern which indicates specific headers to be searched. The search will automatically treat headers which span multiple lines as one long line. This flag implies -h.

    In the style of procmail, special strings in the pattern will be expanded as follows:

        If the regular expression contains "^TO:" it will be substituted by "^((Original-)?(Resent-)?(To|Cc|Bcc)|(X-Envelope|Apparently(-Resent)?)-To):", which should match all headers with destination addresses.

        If the regular expression contains "^FROM_DAEMON:" it will be substituted by "(^(Mailing-List:|Precedence:.*(junk|bulk|list)|To: Multiple recipients of |(((Resent-)?(From|Sender)|X-Envelope-From):|>?From )([^>]*[^(.%@a-z0-9])?(Post(ma?(st(e?r)?|n)|office)|(send)?Mail(er)?|daemon|m(mdf|ajordomo)|n?uucp|LIST(SERV|proc)|NETSERV|o(wner|ps)|r(e(quest|sponse)|oot)|b(ounce|bs\.smtp)|echo|mirror|s(erv(ices?|er)|mtp(error)?|ystem)|A(dmin(istrator)?|MMGR|utoanswer))(([^).!:a-z0-9][-_a-z0-9]*)?[%@>\t ][^<)]*(\(.*\).*)?)?", which should catch mails coming from most daemons.

        If the regular expression contains "^FROM_MAILER:" it will be substituted by "(^(((Resent-)?(From|Sender)|X-Envelope-From):|>?From)([^>]*[^(.%@a-z0-9])?(Post(ma(st(er)?|n)|office)|(send)?Mail(er)?|daemon|mmdf|n?uucp|ops|r(esponse|oot)|(bbs\.)?smtp(error)?|s(erv(ices?|er)|ystem)|A(dmin(istrator)?|MMGR))(([^).!:a-z0-9][-_a-z0-9]*)?[%@>\t][^<)]*(\(.*\).*)?)?$([^>]|$))" (a stripped down version of "^FROM_DAEMON:"), which should catch mails coming from most mailer-daemons.

-Z  By default, grepmail uses the Mail::Folder::FastReader module if it is on the system. This switch tells it to use the slower Perl implementation instead.

--help
    Print a help message summarizing the usage.

EXAMPLES
Count the number of emails. ("." matches every email.)

  grepmail -r . sent-mail

Get all email larger than 2000 bytes about books

  grepmail books -s 2000 sent-mail

Get all email that you mailed yesterday

  grepmail -d yesterday sent-mail

Get all email that you mailed before the first thursday in June 1998 that pertains to research (requires Date::Manip):

  grepmail research -d "before 1st thursday in June 1992" sent-mail

Get all email that you mailed before the first of June 1998 that pertains to research:

  grepmail research -d "before 6/1/92" sent-mail

Get all email you received since 8/20/98 that wasn't about research or your job, ignoring case:

  grepmail -iv "(research|job)" -d "since 8/20/98" saved-mail

Get all email about mime but not about Netscape. Constrain the search to match the body, since most headers contain the text "mime":

  grepmail -b mime saved-mail | grepmail Netscape -v

Print a list of all mailboxes containing a message from Rodney. Constrain the search to the headers, since quoted emails may match the pattern:

  grepmail -hl "^From.*Rodney" saved-mail*

Find all emails with the text "Pilot" in both the header and the body:

  grepmail -hb "Pilot" saved-mail*

Print a count of the number of messages about grepmail in all saved-mail mailboxes:

  grepmail -br grepmail saved-mail*

Remove any duplicates from a mailbox:

  grepmail -u saved-mail

Convert a Gnus mailbox to mbox format:

  grepmail . gnus-mailbox-dir/* > mbox

Search for all emails to or from an address (taking into account wrapped headers and different header names):

  grepmail -Y '(^TO:|^From:)' my@email.address saved-mail

Find all emails from postmasters:

  grepmail -Y '^FROM_MAILER:' . saved-mail

FILES
grepmail will not create temporary files while decompressing compressed archives. The last version to do this was 3.5. While the new design uses more memory, the code is much simpler, and there is less chance that email can be read by malicious third parties. Memory usage is determined by the size of the largest email message in the mailbox.

ENVIRONMENT
The MAIL environment variable can be used to specify the default mail directory. This directory will be searched if the specified mailbox can not be found directly.

BUGS AND LIMITATIONS

Test case 1 fails on some platforms
    Bug not squashed yet. Any info would be appreciated.

File names that look like flags cause problems.
    In some special circumstances, grepmail will be confused by files whose names look like flags. In such cases, use the -e flag to specify the search pattern.

AUTHOR
David Coppit, <david@coppit.org>, http://coppit.org/

SEE ALSO
elm(1), mail(1), grep(1), perl(1), printmail(1), Mail::Internet(3), procmailrc(5). Crocker, D. H., Standard for the Format of Arpa Internet Text Messages, RFC822.