I recently needed to find the largest emails in various email accounts and share the size and subject. Not if it was a single email account which I had access too there are likely much simpler options using webmail or an email client to get the same outcome.
It looks like this hasn’t been written about before so I pieced together various tutorials to end up with the final solution.
This guide assumes you know what you’re doing on the command line prompt and that you have the permissions to view the files and folders below. It also assumes you have the permissions to go poking around in people’s email accounts, so be sure to ask for that before you start outputing private email subjects from their accounts
The first step is to check you have the following results for a list of files in the chosen CPanel account’s mail folder:
$ls -a /home/[account]/mail
The above should show you a folder for each domain, but hopefully also a symlink for each account. In my case:
.email@example_com
The above actually points to example.com/email but we’ll be using it in our code.
This code also expects emails to be stored in files ending with ,Sab or ,RSab or ,S or ,RS so check that too.
So here is the full example which I’ll then break down below. You’ll need to update it to suit your needs:
find /home/[account]/mail/.email\@example_com/ -type f ( -iname "*,Sab" -or -iname "*,RSab" -or -iname "*,S" -or -iname "*,RS" ) -size +1M -exec grep "Subject: " {} \; -printf '%s B - ' | sort -nr | head -10
First we use the find command to list files which match our email file name (end with 4 options) and have a file size of greater than 1M:
find /home/[account]/mail/.email\@example_com/ -type f ( -iname "*,Sab" -or -iname "*,RSab" -or -iname "*,S" -or -iname "*,RS" ) -size +1M
We then trigger an exec on that which will eventually return their subject as part of the output, and also print their file size in bytes (%s) followed by a B and a hyphen with -printf
-exec grep "Subject: " {} \; -printf '%s B - '
We then sort the list:
sort -nr
and finally only return the first 10:
head -10