I have a mailserver and it archives all emails sent and received. The problem is it is also archiving all the spam messages that the postmaster account grabs (which are the ones that score so high they are getting rejected).

The archive directory structure looks like this:

/etc/mail/archive/2008-04-21/

and then under there are all the messages.

What I want to do is from the archive dir, basically say 'delete anything in all the directories under here where this string is found in the file: X-Spam-Status: Yes'.

Note that space after the colon after the word Status..that might make the grep problematic...

Any ideas?

That's not a problem. It can be a problem if there are blank spaces in file names, but you can circumvent it by
the -l option to grep prints only file names with matches. The -Z option separates file names with a NULL character and the -0 option to xargs takes input with fields separated by NULL. In the statement above I put an "echo rm" command to test the result. When you've checked you can strip out the echo command and the files will be actually removed.

ls -1 /etc/mail/archive/2008-04-21/ | while read file
do
grep -q "X-Spam-Status: Yes" $file && rm $file
done

Thanks!

Either one of those worked perfectly!!

Thank you thank you!!!