Hi Barry, That fixed the problem, though why it happened? I have no idea what kinds of things can cause this trouble. Bad attachments?
The last message in the spool was from fail2ban saying a service had been stopped, I get them all the time, nothing unusual about it, so I'm stumped. Initially I had been getting this bounce message originating from the logwatch cron job, for about a week. About permission denied to /var/mail/nkj ... but I was receiving other mail to the same account so wasn't fully concerned (though I was a bit confused, especially considering I was receiving the bounce message fine, just not the original). Then, I came in to work on Monday and noticed I had no email from the weekend (which is impossible since I have nightly reports from several servers). That's when it appeared to be rejecting all mail with the same error. So, the symptom has been resolved, and I hope the problem doesn't sprout up again. Thanks for your help! -Nick On Fri, 2008-03-28 at 08:48 -0500, Barry Brimer wrote: > Corrupted mail spool? Can you stop sendmail long enough to move your mail > spool out of the way and create a new one and start sendmail again? > > On Fri, 28 Mar 2008, Nick Jennings wrote: > > > On Thu, 2008-03-27 at 08:42 -0500, Hugh Brown wrote: > >> In my experience, the user postfix runs as needs to be able to write to > >> the file. Permissions of 600 only allow nkj to write to that file. We > >> use sendmail on our RH boxes, however, on a debian box I have that runs > >> postfix, the permissions on the mail spools is 660 with the user as > >> owner and mail as the group. > > > > > > Hi Hugh, > > > > I tried your suggestion, and it still isn't working. > > > > # ls -l /var/mail/nkj > > -rw-rw---- 1 nkj mail 51200629 Mar 28 08:33 /var/mail/nkj > > > > > > All of the other mail files, however, are user/group owned by the user > > (no mail group) and only rw by user. > > > > I'm still getting the error: > > > > Mar 28 08:33:16 srv1 postfix/local[766]: 0B4C57800B: to=<[EMAIL PROTECTED]>, > > orig_to=<[EMAIL PROTECTED]>, relay=local, delay=0.01, delays=0/0/0/0, > > dsn=5.2.0, status=bounced (can't create user output file. Command > > output: procmail: Error while writing to "/var/mail/nkj" ) > > > > > > > >> > >> Nick Jennings wrote: > >>> Hi Barry and Sam, thanks for your replies, > >>> > >>> SELinux has actually been disabled for some time due to other issues, > >>> so that's not the cause of this problem. Originally, other mail for nkj > >>> was being delivered fine, only mail expanded from the root alias was > >>> failing. However, now I've checked the last message in my spool file was > >>> from March 23rd, even though the timestamp on the nkj spool is March > >>> 27th. > >>> > >>> Very Strange. I have no idea whats going on here. > >>> -Nick > >>> > >>> > >>> On Thu, 2008-03-27 at 11:50 +0000, Sharpe, Sam J wrote: > >>>> On Thu, 2008-03-27 at 12:42 +0100, Nick Jennings wrote: > >>>>> Hi Everyone, > >>>>> > >>>>> I have a strange problem, where when I get an email which was > >>>>> originally sent to root, which expands in the /etc/aliases file to my > >>>>> user account (nkj), procmail is unable to open the file for writing. > >>>>> However I can receive emails which have been sent directly to the nkj > >>>>> account. > >>>>> > >>>>> Here is are the relevant log entries in /var/log/maillog: > >>>>> > >>>>> > >>>>> maillog:Mar 27 06:25:58 srv1 postfix/cleanup[697]: E30DE78006: > >>>>> message-id=<[EMAIL PROTECTED]> > >>>>> maillog:Mar 27 06:25:58 srv1 postfix/qmgr[11986]: E30DE78006: from=<>, > >>>>> size=2227, nrcpt=1 (queue active) > >>>>> maillog:Mar 27 06:25:58 srv1 postfix/bounce[1231]: 5BA8778002: sender > >>>>> non-delivery notification: E30DE78006 > >>>>> maillog:Mar 27 06:25:58 srv1 postfix/local[698]: E30DE78006: > >>>>> to=<[EMAIL PROTECTED]>, orig_to=<[EMAIL PROTECTED]>, relay=local, > >>>>> delay=0.01, > >>>>> delays=0/0/0/0.01, dsn=5.2.0, status=bounced (can't create user output > >>>>> file. Command output: procmail: Error while writing to "/var/mail/nkj" ) > >>>>> maillog:Mar 27 06:25:58 srv1 postfix/qmgr[11986]: E30DE78006: removed > >>>>> > >>>>> > >>>>> > >>>>> As usual, /var/mail is symlinked to /var/spool/mail and here are the > >>>>> relevant perms: > >>>>> > >>>>> > >>>>> [EMAIL PROTECTED] log]# ls -l /var/mail > >>>>> lrwxrwxrwx 1 root root 10 Jan 14 07:37 /var/mail -> spool/mail > >>>>> > >>>>> [EMAIL PROTECTED] log]# ls -l /var/spool/ | grep mail$ > >>>>> drwxrwxrwt 3 root mail 12288 Mar 27 06:07 mail > >>>>> > >>>>> [EMAIL PROTECTED] log]# ls -l /var/spool/mail/nkj > >>>>> -rw------- 1 nkj nkj 51200629 Mar 27 06:25 /var/spool/mail/nkj > >>>>> > >>>>> > >>>>> > >>>>> It should be noted that /var/spool/mail is a mounted partition, with > >>>>> quotas enabled, however there are no quotas set on the nkj account: > >>>>> > >>>>> > >>>>> [EMAIL PROTECTED] log]# mount | grep mail > >>>>> /dev/sda2 on /var/spool/mail type ext3 (rw,usrquota,grpquota) > >>>>> > >>>>> [EMAIL PROTECTED] log]# df -h | grep mail > >>>>> /dev/sda2 30G 283M 28G 1% /var/spool/mail > >>>>> > >>>>> [EMAIL PROTECTED] log]# quota -u nkj > >>>>> Disk quotas for user nkj (uid 500): none > >>>>> [EMAIL PROTECTED] log]# quota -g nkj > >>>>> Disk quotas for group nkj (gid 500): none > >>>>> > >>>>> > >>>>> Any ideas why this is happening? I've been trying to figure this out for > >>>>> a while now with no luck at all, hoping someone here can point me in the > >>>>> right direction. > >>>> What's your SELinux status? Enforcing/Permissive/Disabled? > >>>> > >>>> My first thought, in the absence of any other ideas is that SELinux is > >>>> denying procmail the ability to write to that file. Possibly it's > >>>> because it's mis-labelled. Do you have SELinux alerts in > >>>> your /var/log/messages file? > >>>> > >>>> -- > >>>> Sam > >>>> > >>>> _______________________________________________ > >>>> rhelv5-list mailing list > >>>> [email protected] > >>>> https://www.redhat.com/mailman/listinfo/rhelv5-list > >>> > >>> _______________________________________________ > >>> rhelv5-list mailing list > >>> [email protected] > >>> https://www.redhat.com/mailman/listinfo/rhelv5-list > >> > >> _______________________________________________ > >> rhelv5-list mailing list > >> [email protected] > >> https://www.redhat.com/mailman/listinfo/rhelv5-list > > > > _______________________________________________ > > rhelv5-list mailing list > > [email protected] > > https://www.redhat.com/mailman/listinfo/rhelv5-list > > > > !DSPAM:47ecf59e67659029194002! > > > > > > _______________________________________________ > rhelv5-list mailing list > [email protected] > https://www.redhat.com/mailman/listinfo/rhelv5-list _______________________________________________ rhelv5-list mailing list [email protected] https://www.redhat.com/mailman/listinfo/rhelv5-list
