root sending several emails a minute — can't find out why and who's doing it

The name of the pictureThe name of the pictureThe name of the pictureClash Royale CLAN TAG#URR8PPP











up vote
1
down vote

favorite












I can't seem to figure out why root is sending out several emails every minute. I would like it to stop because I am making out my ability to send emails every 24 hours (over 5k a day).



First thing I have done is trying to forward root email to an external account to maybe get more detail about the emails being sent. This is not what I need to accomplish, just showing you I tried it. Anyways I can't get it to work, the emails do not forward.



[Email Forwarding]



I tried



Edit: /etc/aliases and added `root: myemail@email.com



Edit: /root/.forward and added my email



Both methods didn't forward the emails.



[Cron Jobs]



The next thing I thought and read was that crond was sending the emails due to my cronjobs. Yes, I do have cron jobs that run every minute so I thought this could be the issue.



I tried



Editing /etc/crontab and changing the values



MAILTO=root to MAILTO= as well as I tried MAILTO=""



I also manually changed all the cron jobs to run once an hour to see if they stop, they did not and yet continued.



I also stopped my crond daemon, but root keeps sending mail.



Here is a email example Delivery Report from WHM; I can't see anything that helps.



enter image description here



Here is also what my mailog file looks like and again I can't see anything.



enter image description here



Can anyone point me in the right direction to find out why root is sending emails to root every minute several times?










share|improve this question























  • I dont have a file/dir called mqueue. I have a few but 2 of them are exim and mail. And I am using exim
    – Cesar Bielich
    Nov 29 '16 at 23:32










  • Here is a screenshot from one of the messages snag.gy/SlMnbF.jpg. Looks like it could be a bad address. I am suspecting wordpress is the problem as I do have a few wordpress sites. Is there a way to see which script is sending the message?
    – Cesar Bielich
    Nov 29 '16 at 23:42











  • Looks like I have a ton of "Message is frozen" as well as "mail dropped due to invalid domain." as well. I have A TON of Message is frozen
    – Cesar Bielich
    Nov 29 '16 at 23:53










  • I removed the forwarding a while ago. Its all back to normal
    – Cesar Bielich
    Nov 30 '16 at 0:21










  • I figured it out, thanks so much. I discovered in the maillog that CSF which is the firewall was trying to send to invalid domain. That was is. Make your comment a Answer so I can vote it.
    – Cesar Bielich
    Nov 30 '16 at 0:46














up vote
1
down vote

favorite












I can't seem to figure out why root is sending out several emails every minute. I would like it to stop because I am making out my ability to send emails every 24 hours (over 5k a day).



First thing I have done is trying to forward root email to an external account to maybe get more detail about the emails being sent. This is not what I need to accomplish, just showing you I tried it. Anyways I can't get it to work, the emails do not forward.



[Email Forwarding]



I tried



Edit: /etc/aliases and added `root: myemail@email.com



Edit: /root/.forward and added my email



Both methods didn't forward the emails.



[Cron Jobs]



The next thing I thought and read was that crond was sending the emails due to my cronjobs. Yes, I do have cron jobs that run every minute so I thought this could be the issue.



I tried



Editing /etc/crontab and changing the values



MAILTO=root to MAILTO= as well as I tried MAILTO=""



I also manually changed all the cron jobs to run once an hour to see if they stop, they did not and yet continued.



I also stopped my crond daemon, but root keeps sending mail.



Here is a email example Delivery Report from WHM; I can't see anything that helps.



enter image description here



Here is also what my mailog file looks like and again I can't see anything.



enter image description here



Can anyone point me in the right direction to find out why root is sending emails to root every minute several times?










share|improve this question























  • I dont have a file/dir called mqueue. I have a few but 2 of them are exim and mail. And I am using exim
    – Cesar Bielich
    Nov 29 '16 at 23:32










  • Here is a screenshot from one of the messages snag.gy/SlMnbF.jpg. Looks like it could be a bad address. I am suspecting wordpress is the problem as I do have a few wordpress sites. Is there a way to see which script is sending the message?
    – Cesar Bielich
    Nov 29 '16 at 23:42











  • Looks like I have a ton of "Message is frozen" as well as "mail dropped due to invalid domain." as well. I have A TON of Message is frozen
    – Cesar Bielich
    Nov 29 '16 at 23:53










  • I removed the forwarding a while ago. Its all back to normal
    – Cesar Bielich
    Nov 30 '16 at 0:21










  • I figured it out, thanks so much. I discovered in the maillog that CSF which is the firewall was trying to send to invalid domain. That was is. Make your comment a Answer so I can vote it.
    – Cesar Bielich
    Nov 30 '16 at 0:46












up vote
1
down vote

favorite









up vote
1
down vote

favorite











I can't seem to figure out why root is sending out several emails every minute. I would like it to stop because I am making out my ability to send emails every 24 hours (over 5k a day).



First thing I have done is trying to forward root email to an external account to maybe get more detail about the emails being sent. This is not what I need to accomplish, just showing you I tried it. Anyways I can't get it to work, the emails do not forward.



[Email Forwarding]



I tried



Edit: /etc/aliases and added `root: myemail@email.com



Edit: /root/.forward and added my email



Both methods didn't forward the emails.



[Cron Jobs]



The next thing I thought and read was that crond was sending the emails due to my cronjobs. Yes, I do have cron jobs that run every minute so I thought this could be the issue.



I tried



Editing /etc/crontab and changing the values



MAILTO=root to MAILTO= as well as I tried MAILTO=""



I also manually changed all the cron jobs to run once an hour to see if they stop, they did not and yet continued.



I also stopped my crond daemon, but root keeps sending mail.



Here is a email example Delivery Report from WHM; I can't see anything that helps.



enter image description here



Here is also what my mailog file looks like and again I can't see anything.



enter image description here



Can anyone point me in the right direction to find out why root is sending emails to root every minute several times?










share|improve this question















I can't seem to figure out why root is sending out several emails every minute. I would like it to stop because I am making out my ability to send emails every 24 hours (over 5k a day).



First thing I have done is trying to forward root email to an external account to maybe get more detail about the emails being sent. This is not what I need to accomplish, just showing you I tried it. Anyways I can't get it to work, the emails do not forward.



[Email Forwarding]



I tried



Edit: /etc/aliases and added `root: myemail@email.com



Edit: /root/.forward and added my email



Both methods didn't forward the emails.



[Cron Jobs]



The next thing I thought and read was that crond was sending the emails due to my cronjobs. Yes, I do have cron jobs that run every minute so I thought this could be the issue.



I tried



Editing /etc/crontab and changing the values



MAILTO=root to MAILTO= as well as I tried MAILTO=""



I also manually changed all the cron jobs to run once an hour to see if they stop, they did not and yet continued.



I also stopped my crond daemon, but root keeps sending mail.



Here is a email example Delivery Report from WHM; I can't see anything that helps.



enter image description here



Here is also what my mailog file looks like and again I can't see anything.



enter image description here



Can anyone point me in the right direction to find out why root is sending emails to root every minute several times?







sendmail






share|improve this question















share|improve this question













share|improve this question




share|improve this question








edited Sep 2 at 23:23









Jeff Schaller

32.9k849110




32.9k849110










asked Nov 29 '16 at 22:54









Cesar Bielich

1084




1084











  • I dont have a file/dir called mqueue. I have a few but 2 of them are exim and mail. And I am using exim
    – Cesar Bielich
    Nov 29 '16 at 23:32










  • Here is a screenshot from one of the messages snag.gy/SlMnbF.jpg. Looks like it could be a bad address. I am suspecting wordpress is the problem as I do have a few wordpress sites. Is there a way to see which script is sending the message?
    – Cesar Bielich
    Nov 29 '16 at 23:42











  • Looks like I have a ton of "Message is frozen" as well as "mail dropped due to invalid domain." as well. I have A TON of Message is frozen
    – Cesar Bielich
    Nov 29 '16 at 23:53










  • I removed the forwarding a while ago. Its all back to normal
    – Cesar Bielich
    Nov 30 '16 at 0:21










  • I figured it out, thanks so much. I discovered in the maillog that CSF which is the firewall was trying to send to invalid domain. That was is. Make your comment a Answer so I can vote it.
    – Cesar Bielich
    Nov 30 '16 at 0:46
















  • I dont have a file/dir called mqueue. I have a few but 2 of them are exim and mail. And I am using exim
    – Cesar Bielich
    Nov 29 '16 at 23:32










  • Here is a screenshot from one of the messages snag.gy/SlMnbF.jpg. Looks like it could be a bad address. I am suspecting wordpress is the problem as I do have a few wordpress sites. Is there a way to see which script is sending the message?
    – Cesar Bielich
    Nov 29 '16 at 23:42











  • Looks like I have a ton of "Message is frozen" as well as "mail dropped due to invalid domain." as well. I have A TON of Message is frozen
    – Cesar Bielich
    Nov 29 '16 at 23:53










  • I removed the forwarding a while ago. Its all back to normal
    – Cesar Bielich
    Nov 30 '16 at 0:21










  • I figured it out, thanks so much. I discovered in the maillog that CSF which is the firewall was trying to send to invalid domain. That was is. Make your comment a Answer so I can vote it.
    – Cesar Bielich
    Nov 30 '16 at 0:46















I dont have a file/dir called mqueue. I have a few but 2 of them are exim and mail. And I am using exim
– Cesar Bielich
Nov 29 '16 at 23:32




I dont have a file/dir called mqueue. I have a few but 2 of them are exim and mail. And I am using exim
– Cesar Bielich
Nov 29 '16 at 23:32












Here is a screenshot from one of the messages snag.gy/SlMnbF.jpg. Looks like it could be a bad address. I am suspecting wordpress is the problem as I do have a few wordpress sites. Is there a way to see which script is sending the message?
– Cesar Bielich
Nov 29 '16 at 23:42





Here is a screenshot from one of the messages snag.gy/SlMnbF.jpg. Looks like it could be a bad address. I am suspecting wordpress is the problem as I do have a few wordpress sites. Is there a way to see which script is sending the message?
– Cesar Bielich
Nov 29 '16 at 23:42













Looks like I have a ton of "Message is frozen" as well as "mail dropped due to invalid domain." as well. I have A TON of Message is frozen
– Cesar Bielich
Nov 29 '16 at 23:53




Looks like I have a ton of "Message is frozen" as well as "mail dropped due to invalid domain." as well. I have A TON of Message is frozen
– Cesar Bielich
Nov 29 '16 at 23:53












I removed the forwarding a while ago. Its all back to normal
– Cesar Bielich
Nov 30 '16 at 0:21




I removed the forwarding a while ago. Its all back to normal
– Cesar Bielich
Nov 30 '16 at 0:21












I figured it out, thanks so much. I discovered in the maillog that CSF which is the firewall was trying to send to invalid domain. That was is. Make your comment a Answer so I can vote it.
– Cesar Bielich
Nov 30 '16 at 0:46




I figured it out, thanks so much. I discovered in the maillog that CSF which is the firewall was trying to send to invalid domain. That was is. Make your comment a Answer so I can vote it.
– Cesar Bielich
Nov 30 '16 at 0:46










2 Answers
2






active

oldest

votes

















up vote
3
down vote



accepted










This is a debugging process not a solution.



First of all you should probably determine which Mail Transport Agent you're using. For example, sendmail, exim4, postfix, msmtp, or one of the several others. Looking in /etc/init.d or running ps -ef may shed light on this.



Having determined you're using exim4 the interesting places to look are the main delivery logfile /var/log/exim4/mainlog and the spool directory /var/spool/exim4/input. (For sendmail, at least, the equivalent spool directory is /var/spool/mqueue.) Messages for exim4 are transiently stored in the spool directory split as header and body:



1cC1ss-0002rV-Pw-D # Data (message body)
1cC1ss-0002rV-Pw-H # Headers
1cC1ss-0002rV-Pw-J # Job control (may not be present)


The obvious /var/log/mail.log won't contain messages from exim4 (although it will for true sendmail). In your case it only contains messages from dovecot, which is an IMAP server, and so of little relevance in this situation.



It's probably worth switching off the MTA temporarily so that it doesn't attempt to process the queue:



service exim4 stop


And it's definitely worth removing the forwarding for root that you've added. Otherwise a bounce will get returned to root, which will forward it offsite, generating a non-delivery bounce, which will get returned to root, which will forward it offsite, generating a non-delivery bounce, which will continue ad infinitum.



Ignoring transport delivery issues (frozen messages, non-delivery bounces, etc), hopefully the content of the remaining messages will help shed light on the sender process or true cause of the error.






share|improve this answer



























    up vote
    0
    down vote













    There are errors or warnings being generated by your system. To see what is causing the problem go to WHM's "Mail Queue Manager". There you will see messages sent from root to root. Click the "Actions" button on the far right column to view the message. That will show you the error or warning that you need to remedy.






    share|improve this answer




















      Your Answer







      StackExchange.ready(function()
      var channelOptions =
      tags: "".split(" "),
      id: "106"
      ;
      initTagRenderer("".split(" "), "".split(" "), channelOptions);

      StackExchange.using("externalEditor", function()
      // Have to fire editor after snippets, if snippets enabled
      if (StackExchange.settings.snippets.snippetsEnabled)
      StackExchange.using("snippets", function()
      createEditor();
      );

      else
      createEditor();

      );

      function createEditor()
      StackExchange.prepareEditor(
      heartbeatType: 'answer',
      convertImagesToLinks: false,
      noModals: false,
      showLowRepImageUploadWarning: true,
      reputationToPostImages: null,
      bindNavPrevention: true,
      postfix: "",
      onDemand: true,
      discardSelector: ".discard-answer"
      ,immediatelyShowMarkdownHelp:true
      );



      );













       

      draft saved


      draft discarded


















      StackExchange.ready(
      function ()
      StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2funix.stackexchange.com%2fquestions%2f326934%2froot-sending-several-emails-a-minute-cant-find-out-why-and-whos-doing-it%23new-answer', 'question_page');

      );

      Post as a guest






























      2 Answers
      2






      active

      oldest

      votes








      2 Answers
      2






      active

      oldest

      votes









      active

      oldest

      votes






      active

      oldest

      votes








      up vote
      3
      down vote



      accepted










      This is a debugging process not a solution.



      First of all you should probably determine which Mail Transport Agent you're using. For example, sendmail, exim4, postfix, msmtp, or one of the several others. Looking in /etc/init.d or running ps -ef may shed light on this.



      Having determined you're using exim4 the interesting places to look are the main delivery logfile /var/log/exim4/mainlog and the spool directory /var/spool/exim4/input. (For sendmail, at least, the equivalent spool directory is /var/spool/mqueue.) Messages for exim4 are transiently stored in the spool directory split as header and body:



      1cC1ss-0002rV-Pw-D # Data (message body)
      1cC1ss-0002rV-Pw-H # Headers
      1cC1ss-0002rV-Pw-J # Job control (may not be present)


      The obvious /var/log/mail.log won't contain messages from exim4 (although it will for true sendmail). In your case it only contains messages from dovecot, which is an IMAP server, and so of little relevance in this situation.



      It's probably worth switching off the MTA temporarily so that it doesn't attempt to process the queue:



      service exim4 stop


      And it's definitely worth removing the forwarding for root that you've added. Otherwise a bounce will get returned to root, which will forward it offsite, generating a non-delivery bounce, which will get returned to root, which will forward it offsite, generating a non-delivery bounce, which will continue ad infinitum.



      Ignoring transport delivery issues (frozen messages, non-delivery bounces, etc), hopefully the content of the remaining messages will help shed light on the sender process or true cause of the error.






      share|improve this answer
























        up vote
        3
        down vote



        accepted










        This is a debugging process not a solution.



        First of all you should probably determine which Mail Transport Agent you're using. For example, sendmail, exim4, postfix, msmtp, or one of the several others. Looking in /etc/init.d or running ps -ef may shed light on this.



        Having determined you're using exim4 the interesting places to look are the main delivery logfile /var/log/exim4/mainlog and the spool directory /var/spool/exim4/input. (For sendmail, at least, the equivalent spool directory is /var/spool/mqueue.) Messages for exim4 are transiently stored in the spool directory split as header and body:



        1cC1ss-0002rV-Pw-D # Data (message body)
        1cC1ss-0002rV-Pw-H # Headers
        1cC1ss-0002rV-Pw-J # Job control (may not be present)


        The obvious /var/log/mail.log won't contain messages from exim4 (although it will for true sendmail). In your case it only contains messages from dovecot, which is an IMAP server, and so of little relevance in this situation.



        It's probably worth switching off the MTA temporarily so that it doesn't attempt to process the queue:



        service exim4 stop


        And it's definitely worth removing the forwarding for root that you've added. Otherwise a bounce will get returned to root, which will forward it offsite, generating a non-delivery bounce, which will get returned to root, which will forward it offsite, generating a non-delivery bounce, which will continue ad infinitum.



        Ignoring transport delivery issues (frozen messages, non-delivery bounces, etc), hopefully the content of the remaining messages will help shed light on the sender process or true cause of the error.






        share|improve this answer






















          up vote
          3
          down vote



          accepted







          up vote
          3
          down vote



          accepted






          This is a debugging process not a solution.



          First of all you should probably determine which Mail Transport Agent you're using. For example, sendmail, exim4, postfix, msmtp, or one of the several others. Looking in /etc/init.d or running ps -ef may shed light on this.



          Having determined you're using exim4 the interesting places to look are the main delivery logfile /var/log/exim4/mainlog and the spool directory /var/spool/exim4/input. (For sendmail, at least, the equivalent spool directory is /var/spool/mqueue.) Messages for exim4 are transiently stored in the spool directory split as header and body:



          1cC1ss-0002rV-Pw-D # Data (message body)
          1cC1ss-0002rV-Pw-H # Headers
          1cC1ss-0002rV-Pw-J # Job control (may not be present)


          The obvious /var/log/mail.log won't contain messages from exim4 (although it will for true sendmail). In your case it only contains messages from dovecot, which is an IMAP server, and so of little relevance in this situation.



          It's probably worth switching off the MTA temporarily so that it doesn't attempt to process the queue:



          service exim4 stop


          And it's definitely worth removing the forwarding for root that you've added. Otherwise a bounce will get returned to root, which will forward it offsite, generating a non-delivery bounce, which will get returned to root, which will forward it offsite, generating a non-delivery bounce, which will continue ad infinitum.



          Ignoring transport delivery issues (frozen messages, non-delivery bounces, etc), hopefully the content of the remaining messages will help shed light on the sender process or true cause of the error.






          share|improve this answer












          This is a debugging process not a solution.



          First of all you should probably determine which Mail Transport Agent you're using. For example, sendmail, exim4, postfix, msmtp, or one of the several others. Looking in /etc/init.d or running ps -ef may shed light on this.



          Having determined you're using exim4 the interesting places to look are the main delivery logfile /var/log/exim4/mainlog and the spool directory /var/spool/exim4/input. (For sendmail, at least, the equivalent spool directory is /var/spool/mqueue.) Messages for exim4 are transiently stored in the spool directory split as header and body:



          1cC1ss-0002rV-Pw-D # Data (message body)
          1cC1ss-0002rV-Pw-H # Headers
          1cC1ss-0002rV-Pw-J # Job control (may not be present)


          The obvious /var/log/mail.log won't contain messages from exim4 (although it will for true sendmail). In your case it only contains messages from dovecot, which is an IMAP server, and so of little relevance in this situation.



          It's probably worth switching off the MTA temporarily so that it doesn't attempt to process the queue:



          service exim4 stop


          And it's definitely worth removing the forwarding for root that you've added. Otherwise a bounce will get returned to root, which will forward it offsite, generating a non-delivery bounce, which will get returned to root, which will forward it offsite, generating a non-delivery bounce, which will continue ad infinitum.



          Ignoring transport delivery issues (frozen messages, non-delivery bounces, etc), hopefully the content of the remaining messages will help shed light on the sender process or true cause of the error.







          share|improve this answer












          share|improve this answer



          share|improve this answer










          answered Nov 30 '16 at 10:20









          roaima

          40.6k547110




          40.6k547110






















              up vote
              0
              down vote













              There are errors or warnings being generated by your system. To see what is causing the problem go to WHM's "Mail Queue Manager". There you will see messages sent from root to root. Click the "Actions" button on the far right column to view the message. That will show you the error or warning that you need to remedy.






              share|improve this answer
























                up vote
                0
                down vote













                There are errors or warnings being generated by your system. To see what is causing the problem go to WHM's "Mail Queue Manager". There you will see messages sent from root to root. Click the "Actions" button on the far right column to view the message. That will show you the error or warning that you need to remedy.






                share|improve this answer






















                  up vote
                  0
                  down vote










                  up vote
                  0
                  down vote









                  There are errors or warnings being generated by your system. To see what is causing the problem go to WHM's "Mail Queue Manager". There you will see messages sent from root to root. Click the "Actions" button on the far right column to view the message. That will show you the error or warning that you need to remedy.






                  share|improve this answer












                  There are errors or warnings being generated by your system. To see what is causing the problem go to WHM's "Mail Queue Manager". There you will see messages sent from root to root. Click the "Actions" button on the far right column to view the message. That will show you the error or warning that you need to remedy.







                  share|improve this answer












                  share|improve this answer



                  share|improve this answer










                  answered Jul 7 at 18:38









                  Tom Baucom

                  1




                  1



























                       

                      draft saved


                      draft discarded















































                       


                      draft saved


                      draft discarded














                      StackExchange.ready(
                      function ()
                      StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2funix.stackexchange.com%2fquestions%2f326934%2froot-sending-several-emails-a-minute-cant-find-out-why-and-whos-doing-it%23new-answer', 'question_page');

                      );

                      Post as a guest













































































                      Popular posts from this blog

                      How to check contact read email or not when send email to Individual?

                      Displaying single band from multi-band raster using QGIS

                      How many registers does an x86_64 CPU actually have?