Unknown postfix root emails in logs that repeat

SYSTEM INFORMATION
OS type and version Ubuntu 20.04
Webmin version 2.101
Virtualmin version 7.8.2

I keep seeing the following in the mail.log every 30 seconds to a minute or so:

Sep 27 02:04:02 srv1 postfix/local[43614]: 456971C1AD8: to=root@srv1.mydomain.net.au, orig_to=, relay=local, delay=0.81, delays=0.1/0/0/0.71, dsn=2.0.0, status=sent (delivered to command: /usr/bin/procmail-wrapper -o -a $DOMAIN -d $LOGNAME)
Sep 27 02:04:02 srv1 postfix/qmgr[43463]: 456971C1AD8: removed

Just wondering if anyone knows what these might be?

These are occurring automatically.

EDIT: If I stop cron entirely, these stop appearing in the logs. How can I figure out which cron job is causing this and what relation it would have?

how about one at a time. or identify which is triggered “every 30 seconds to a minute” or have you added a cron job beyond the standard.
If it is a cron job then is there a timed email stuck in the queue?

More disturbing is that you aren’t getting the emails to see what they are?

Open your mail for root and see what they are.

There is no mail in the root mailbox when I check.
Screenshot 2023-09-27 110123

I’m guessing this log is some sort of internal processing going on.

Seems to be caused by a script I created to check the mail.log and have running every minute under cron. It checks if too many emails are sent within a minute. I don’t see how this would be causing these lines in the log as per my first post. Any ideas?

#!/bin/bash

# Set the threshold for the number of emails in the last minute
THRESHOLD=5

# Log file for postfix
LOG_FILE="/var/log/mail.log"

# Calculate the timestamp for one minute ago
ONE_MINUTE_AGO=$(date -d '1 minute ago' '+%b %e %H:%M')

# Count the number of emails in the last minute
EMAIL_COUNT=$(grep "$ONE_MINUTE_AGO" "$LOG_FILE" | grep -E "(status=sent|status=(bounced|deferred))" | wc -l)

# Check if the email count exceeds the threshold
if [ "$EMAIL_COUNT" -ge "$THRESHOLD" ]; then
    echo "Email count in the last minute: $EMAIL_COUNT. Threshold exceeded. Sending notification."

    # Send a notification email
    echo "WARNING! Email Threshold Exceeded. Check postfix immediately!" | mail -s "Email Threshold Exceeded" kyle@mydomain.net.au
else
    echo "Email count in the last minute: $EMAIL_COUNT. Threshold not exceeded."
fi

Doesn’t cron send notifications via email to root by default? I see MAILTO=root on my systems, but maybe that’s a RHEL-ism.

Not too sure, but I think you might be right.

I added >> /dev/null 2>&1 to the end of the cron command that runs the script to suppress any outputs that job might be generating. Nothing more showing up in the log anymore.

This topic was automatically closed 8 days after the last reply. New replies are no longer allowed.