Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Running debian testing(wheezy) on a virtual host as a web server/mysql server.

It's got logwatch installed, and occasionally I'm getting a mail bounce to an invalid address.

It's inconsistent in timing, and is directed to which is invalid. (its hosted on gmail apps, and now occurs to me I can add that email to find what its sending, but question remains if that's not an option).

I check the exim logs and it has no additional information beyond what's in logwatch.

 2012-09-18 06:27:38 ** R=dnslookup T=remote_smtp: SMTP error from remote mail server after RCPT TO:<>: host []: 550-5.1.1 The email account that you tried to reach does not exist. Please try\n550-5.1.1 double-checking the recipient's email address 

So any ideas to figure out what script could be sending this mail? Exim configuration maybe for more debug? It isn't putting out any logs but mainlog, no error or panic.

I've tried grepping on config files looking for that email address, but no luck.

Edit: its not the logwatch message itself, that part works fine. Its the content of that message that references the bad email bounce. (ie, logwatch is correctly reporting the eximlog)

share|improve this question

This isn't an exim problem, it is a logwatch configuration problem. Fix it by properly configuring logwatch to send it to the desired email address. You do this by editing /etc/cron.daily/0logwatch and set:

$Config{'mailto'} = "user\";

where user is a valid mailbox in your domain.

An alternative method is to put an alias for root in your /etc/aliases file (assuming you have a router that parses that file) to send it to the desired person or people, but then you get ALL email for root, not just the one that you asked about here.

share|improve this answer
No, its not logwatch that is sending the message, logwatch is sending it to the correct address, and inside that log it notes the exim log which has the incorrect address. – user138246 Sep 24 '12 at 20:09
You can enable more logging (log_selector = +all), but this probably will not help. Alias for root and looking at content of the message - will. – dsznajder Mar 31 '13 at 17:30

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.