I have CentOS 6.7 with Apache, PHP and CakePHP 3.0 installed. I just checked up on my /var/log/maillog. I have this logged every 5min without fail. Does anyone know who's doing this and why? Or how I can identity who is doing this and why?

Apr 24 10:35:01 ip-1xx-xx-xx-1xx sendmail[30895]: u3OHZ16M030895: from=root, size=347, class=0, nrcpts=1, msgid=<201604241735.u3OHZ16M030895@ip-1xx-xx-xx-1xx.secureserver.net>, relay=root@localhost
Apr 24 10:35:01 ip-1xx-xx-xx-1xx sendmail[30896]: u3OHZ1UJ030896: from=<root@ip-1xx-xx-xx-1xx.secureserver.net>, size=674, class=0, nrcpts=1, msgid=<201604241735.u3OHZ16M030895@ip-1xx-xx-xx-1xx.secureserver.net>, proto=ESMTP, daemon=MTA, relay=localhost []
Apr 24 10:35:01 ip-1xx-xx-xx-1xx sendmail[30895]: u3OHZ16M030895: to=root, ctladdr=root (0/0), delay=00:00:00, xdelay=00:00:00, mailer=relay, pri=30347, relay=[] [], dsn=2.0.0, stat=Sent (u3OHZ1UJ030896 Message accepted for delivery)
Apr 24 10:35:01 ip-1xx-xx-xx-1xx sendmail[30897]: u3OHZ1UJ030896: to=<root@ip-1xx-xx-xx-1xx.secureserver.net>, ctladdr=<root@ip-1xx-xx-xx-1xx.secureserver.net> (0/0), delay=00:00:00, xdelay=00:00:00, mailer=local, pri=30927, dsn=2.0.0, stat=Sent

As you can see, once you group those log entries by internal message ID, those are email messages that stay within your server:

u3OHZ16M030895: from=root ...
u3OHZ16M030895: to=root ... (u3OHZ1UJ030896 Message accepted for delivery)


u3OHZ1UJ030896: from=<root@ip-1xx-xx-xx-1xx.secureserver.net> ...
u3OHZ1UJ030896: to=<root@ip-1xx-xx-xx-1xx.secureserver.net> ... mailer=local ... 

which mainly looks look sendmail rewriting the address from plain root to root@fully-qualified-hostname hence the two message ID's for a single message.

You would start by actually reading the mailbox for the root user ... An educated random guess would be a scheduled job (cron) that generates standard output.

  • Well I have a cron job running every 5min, but it definitely does not explicitly send an e-mail. Maurizio seems to be addressing why a cron job would somehow generate an auto-email in his answer.
    – Joe C
    Apr 25 '16 at 16:29

Hbruijn response seems to be correct, bsically, whenever any user in the machine (root or other) has a cript running in brtch mode without a window where toi address standard output messages, such a messages are addressed to @ address and, even, addressed to root, meanng "Warning: you have some process writing message you cannot red, so take care of email".

  • Coincidentally I have my only cron job that I added running exactly every 5min. However that cron job is an extremely brief bash script that does NOT send any e-mails. Are you saying that even though its bash script does not explicitly send an e-mail it somehow causes an e-mail to be sent? If so then why? And what's the way to run a bash script in a cron without it generating an e-mail?
    – Joe C
    Apr 25 '16 at 16:26
  • @JoeC generally speaking, you'll need to append something to send the output to a bit bucket. For example: 0 1 5 10 * /path/to/script.sh >/dev/null 2>&1 For further details, see: cyberciti.biz/faq/disable-the-mail-alert-by-crontab-command
    – Mike B
    Apr 25 '16 at 17:26

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.