Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Im attempting to parse some sendmail logs. Im running into lots of apparent emails that have no recipients - or so it would appear.

Mar 18 19:12:35 castor sendmail[543]: q2J2CYIv000543: from=<paj@otech.org>, size=0, class=0, nrcpts=1, proto=ESMTP, daemon=MTA-SSL, relay=somehost.net [6.7.36.178]
Mar 18 19:12:35 castor sendmail[543]: q2J2CYIw000543: from=<paj@otech.org>, size=0, class=0, nrcpts=0, proto=ESMTP, daemon=MTA-SSL, relay=somehost.net [6.7.36.178]
Mar 18 19:12:35 castor sendmail[543]: q2J2CYIx000543: from=<paj@otech.org>, size=0, class=0, nrcpts=0, proto=ESMTP, daemon=MTA-SSL, relay=somehost.net [6.7.36.178]
Mar 18 19:12:35 castor sendmail[543]: q2J2CYJ0000543: from=<paj@otech.org>, size=0, class=0, nrcpts=0, proto=ESMTP, daemon=MTA-SSL, relay=somehost.net [6.7.36.178]
Mar 18 19:12:35 castor sendmail[543]: q2J2CYJ1000543: from=<paj@otech.org>, size=0, class=0, nrcpts=0, proto=ESMTP, daemon=MTA-SSL, relay=somehost.net [6.7.36.178]
Mar 18 19:12:35 castor sendmail[543]: q2J2CYJ2000543: from=<paj@otech.org>, size=0, class=0, nrcpts=0, proto=ESMTP, daemon=MTA-SSL, relay=somehost.net [76.27.206.178]

First - it look like these are all from the same PID (543) yet one has 'nrcpts=1' while the rest are zero. Second - all are 'size=0'

What do these lines indicate? Searching the log doesn't show any other reference to this PID (or whatever it is).

share|improve this question
    
Just to confirm, is the message id for all of these entries really q2J2CYIv000543? –  Mike B Mar 22 '12 at 15:02

1 Answer 1

up vote 1 down vote accepted

nrcpts=0 means that the mail was temporarily rejected right after the MAIL FROM: command at the SMTP dialog.

share|improve this answer
    
rejected by another server? –  ethrbunny Mar 21 '12 at 19:59
1  
grep q2J2CYIv000543 /var/log/mail.log will tell you. In my logs they are rejected by my servers –  adamo Mar 22 '12 at 11:07
    
@adamo don't you mean grep q2J2CYIv000543 /var/log/maillog (no dot in the middle of the file)? –  Mike B Mar 22 '12 at 15:03
1  
@MikeB On my Debian systems it is mail.log. On my BSD ones maillog :) –  adamo Mar 22 '12 at 16:35
    
Interesting! Good info. Thanks. –  Mike B Mar 22 '12 at 16:56

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.