2

I can't seem to figure out why root is sending out several emails every minute. I would like it to stop because I am making out my ability to send emails every 24 hours (over 5k a day).

First thing I have done is trying to forward root email to an external account to maybe get more detail about the emails being sent. This is not what I need to accomplish, just showing you I tried it. Anyways I can't get it to work, the emails do not forward.

[Email Forwarding]

I tried

Edit: /etc/aliases and added `root: myemail@email.com

Edit: /root/.forward and added my email

Both methods didn't forward the emails.

[Cron Jobs]

The next thing I thought and read was that crond was sending the emails due to my cronjobs. Yes, I do have cron jobs that run every minute so I thought this could be the issue.

I tried

Editing /etc/crontab and changing the values

MAILTO=root to MAILTO= as well as I tried MAILTO=""

I also manually changed all the cron jobs to run once an hour to see if they stop, they did not and yet continued.

I also stopped my crond daemon, but root keeps sending mail.

Here is a email example Delivery Report from WHM; I can't see anything that helps.

enter image description here

Here is also what my mailog file looks like and again I can't see anything.

enter image description here

Can anyone point me in the right direction to find out why root is sending emails to root every minute several times?

Jeff Schaller
  • 67,283
  • 35
  • 116
  • 255
Cesar Bielich
  • 123
  • 1
  • 5
  • I dont have a file/dir called mqueue. I have a few but 2 of them are exim and mail. And I am using exim – Cesar Bielich Nov 29 '16 at 23:32
  • Here is a screenshot from one of the messages https://snag.gy/SlMnbF.jpg. Looks like it could be a bad address. I am suspecting wordpress is the problem as I do have a few wordpress sites. Is there a way to see which script is sending the message? – Cesar Bielich Nov 29 '16 at 23:42
  • Looks like I have a ton of "Message is frozen" as well as "mail dropped due to invalid domain." as well. I have A TON of Message is frozen – Cesar Bielich Nov 29 '16 at 23:53
  • I removed the forwarding a while ago. Its all back to normal – Cesar Bielich Nov 30 '16 at 00:21
  • I figured it out, thanks so much. I discovered in the maillog that CSF which is the firewall was trying to send to invalid domain. That was is. Make your comment a Answer so I can vote it. – Cesar Bielich Nov 30 '16 at 00:46

2 Answers2

4

This is a debugging process not a solution.

First of all you should probably determine which Mail Transport Agent you're using. For example, sendmail, exim4, postfix, msmtp, or one of the several others. Looking in /etc/init.d or running ps -ef may shed light on this.

Having determined you're using exim4 the interesting places to look are the main delivery logfile /var/log/exim4/mainlog and the spool directory /var/spool/exim4/input. (For sendmail, at least, the equivalent spool directory is /var/spool/mqueue.) Messages for exim4 are transiently stored in the spool directory split as header and body:

1cC1ss-0002rV-Pw-D    # Data (message body)
1cC1ss-0002rV-Pw-H    # Headers
1cC1ss-0002rV-Pw-J    # Job control (may not be present)

The obvious /var/log/mail.log won't contain messages from exim4 (although it will for true sendmail). In your case it only contains messages from dovecot, which is an IMAP server, and so of little relevance in this situation.

It's probably worth switching off the MTA temporarily so that it doesn't attempt to process the queue:

service exim4 stop

And it's definitely worth removing the forwarding for root that you've added. Otherwise a bounce will get returned to root, which will forward it offsite, generating a non-delivery bounce, which will get returned to root, which will forward it offsite, generating a non-delivery bounce, which will continue ad infinitum.

Ignoring transport delivery issues (frozen messages, non-delivery bounces, etc), hopefully the content of the remaining messages will help shed light on the sender process or true cause of the error.

Chris Davies
  • 116,213
  • 16
  • 160
  • 287
0

There are errors or warnings being generated by your system. To see what is causing the problem go to WHM's "Mail Queue Manager". There you will see messages sent from root to root. Click the "Actions" button on the far right column to view the message. That will show you the error or warning that you need to remedy.

Tom Baucom
  • 1