2

Im attempting to parse some sendmail logs. Im running into lots of apparent emails that have no recipients - or so it would appear.

Mar 18 19:12:35 castor sendmail[543]: q2J2CYIv000543: from=<paj@otech.org>, size=0, class=0, nrcpts=1, proto=ESMTP, daemon=MTA-SSL, relay=somehost.net [6.7.36.178]
Mar 18 19:12:35 castor sendmail[543]: q2J2CYIw000543: from=<paj@otech.org>, size=0, class=0, nrcpts=0, proto=ESMTP, daemon=MTA-SSL, relay=somehost.net [6.7.36.178]
Mar 18 19:12:35 castor sendmail[543]: q2J2CYIx000543: from=<paj@otech.org>, size=0, class=0, nrcpts=0, proto=ESMTP, daemon=MTA-SSL, relay=somehost.net [6.7.36.178]
Mar 18 19:12:35 castor sendmail[543]: q2J2CYJ0000543: from=<paj@otech.org>, size=0, class=0, nrcpts=0, proto=ESMTP, daemon=MTA-SSL, relay=somehost.net [6.7.36.178]
Mar 18 19:12:35 castor sendmail[543]: q2J2CYJ1000543: from=<paj@otech.org>, size=0, class=0, nrcpts=0, proto=ESMTP, daemon=MTA-SSL, relay=somehost.net [6.7.36.178]
Mar 18 19:12:35 castor sendmail[543]: q2J2CYJ2000543: from=<paj@otech.org>, size=0, class=0, nrcpts=0, proto=ESMTP, daemon=MTA-SSL, relay=somehost.net [76.27.206.178]

First - it look like these are all from the same PID (543) yet one has 'nrcpts=1' while the rest are zero. Second - all are 'size=0'

What do these lines indicate? Searching the log doesn't show any other reference to this PID (or whatever it is).

  • Just to confirm, is the message id for all of these entries really q2J2CYIv000543? – Mike B Mar 22 '12 at 15:02
1

nrcpts=0 means that the mail was temporarily rejected right after the MAIL FROM: command at the SMTP dialog.

  • rejected by another server? – ethrbunny Mar 21 '12 at 19:59
  • 1
    grep q2J2CYIv000543 /var/log/mail.log will tell you. In my logs they are rejected by my servers – adamo Mar 22 '12 at 11:07
  • @adamo don't you mean grep q2J2CYIv000543 /var/log/maillog (no dot in the middle of the file)? – Mike B Mar 22 '12 at 15:03
  • 1
    @MikeB On my Debian systems it is mail.log. On my BSD ones maillog :) – adamo Mar 22 '12 at 16:35

Your Answer

By clicking "Post Your Answer", you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.