From logwatch, is this a common entry

Hello Folks:

Not sure what to do with this, how can I determine what is trying to mail to
what program?

<|paula [at] abc.ns.ca>... Cannot mail directly to programs: 12 Time(s)

Thanks for any assistance,

Darryl
Darryl Bach [ Mo, 08 Oktober 2007 00:59 ] [ ID #1839766 ]

Re: From logwatch, is this a common entry

In article <mxdOi.10101$Cj1.9185 [at] edtnps90>,
"Darryl Bach" <dbach [at] seaside.ns.ca> wrote:

> Hello Folks:
>
> Not sure what to do with this, how can I determine what is trying to mail to
> what program?
>
> <|paula [at] abc.ns.ca>... Cannot mail directly to programs: 12 Time(s)

You have to start by looking at the real log. Apparently 'logwatch' is
hiding useful information from you.

Sendmail puts a queue ID into most log lines so that all of the lines
associated with a particular piece of mail can be grouped together based
on the queue ID. Any tool that tries to work with sendmail logs needs to
know and use that fact, or it is likely to be worst than useless.

--
Now where did I hide that website...
Bill Cole [ Mo, 08 Oktober 2007 01:49 ] [ ID #1839767 ]

Re: From logwatch, is this a common entry

In article <mxdOi.10101$Cj1.9185 [at] edtnps90>,
Darryl Bach <dbach [at] seaside.ns.ca> wrote:
>Hello Folks:
>
>Not sure what to do with this, how can I determine what is trying to mail to
>what program?
>
><|paula [at] abc.ns.ca>... Cannot mail directly to programs: 12 Time(s)
>
>Thanks for any assistance,

A) don't believe the error message text. it is somewhat misleading.
B) notice that thefirst caracter of the email address is a 'pipe' character.
C) note that that (unescaped) is an -illegal- charater for a user name.


going out on a limb, "somebody" may confused '.forward' syntax with what
is required for 'aliases', etc.

anyway, what you have to do is visit the -actual- Sendmail logfile find the
messageID number associated with a line referencing '|paula', and then find
-all- the other log lines with the same messageID.

*THEN* you will have the information to figure out 'who sent the message',
and 'where it came from', that is generating the error.
bonomi [ Mo, 08 Oktober 2007 23:19 ] [ ID #1839779 ]

Re: From logwatch, is this a common entry

In news:mxdOi.10101$Cj1.9185 [at] edtnps90,
Darryl Bach <dbach [at] seaside.ns.ca> wrote:

> Not sure what to do with this, how can I determine what is trying to
> mail to what program?
>
> <|paula [at] abc.ns.ca>... Cannot mail directly to programs: 12 Time(s)

One often sees this message when the alias or mail directive specifies a
program, rather than piping to the program. e.g.:

address: /usr/bin/someprogram

results in the above error, while

address: "| /usr/bin/someprogram"

works as expected.
Gretch [ Mo, 08 Oktober 2007 23:37 ] [ ID #1839780 ]

Re: From logwatch, is this a common entry

In article <13gl7mifs37ge04 [at] corp.supernews.com>
bonomi [at] host122.r-bonomi.com (Robert Bonomi) writes:
>In article <mxdOi.10101$Cj1.9185 [at] edtnps90>,
>Darryl Bach <dbach [at] seaside.ns.ca> wrote:
>>Hello Folks:
>>
>>Not sure what to do with this, how can I determine what is trying to mail to
>>what program?
>>
>><|paula [at] abc.ns.ca>... Cannot mail directly to programs: 12 Time(s)
>>
>>Thanks for any assistance,
>
>A) don't believe the error message text. it is somewhat misleading.

Hm, not much I think. From sendmail's point of view, someone tried to
send mail to the "program" 'paula [at] abc.ns.ca'.

>B) notice that thefirst caracter of the email address is a 'pipe' character.
>C) note that that (unescaped) is an -illegal- charater for a user name.
>
>
>going out on a limb, "somebody" may confused '.forward' syntax with what
>is required for 'aliases', etc.

Hm hm, "|/path/to/program" is allowed in both. The error comes when
sendmail gets such an "address" from some *other* source than
..forward/aliases, e.g. in RCPT To: in SMTP.

>anyway, what you have to do is visit the -actual- Sendmail logfile find the
>messageID number associated with a line referencing '|paula', and then find
>-all- the other log lines with the same messageID.
>
>*THEN* you will have the information to figure out 'who sent the message',
>and 'where it came from', that is generating the error.

Agreed.

--Per Hedeland
per [at] hedeland.org
per [ Di, 09 Oktober 2007 23:57 ] [ ID #1840815 ]

Re: From logwatch, is this a common entry

In article <5mvm8dFf1n88U1 [at] mid.individual.net> "Gretch"
<gretchen [at] invalid.corn> writes:
>In news:mxdOi.10101$Cj1.9185 [at] edtnps90,
>Darryl Bach <dbach [at] seaside.ns.ca> wrote:
>
>> Not sure what to do with this, how can I determine what is trying to
>> mail to what program?
>>
>> <|paula [at] abc.ns.ca>... Cannot mail directly to programs: 12 Time(s)
>
>One often sees this message when the alias or mail directive specifies a
>program, rather than piping to the program. e.g.:
>
> address: /usr/bin/someprogram
>
>results in the above error, while

No it doesn't, it results in a "Can't create output" error - or an
overwritten file, if permissions allow.

--Per Hedeland
per [at] hedeland.org
per [ Mi, 10 Oktober 2007 00:02 ] [ ID #1840816 ]

Re: From logwatch, is this a common entry

Thanks for the very informative responses
Really appreciate it
"Gretch" <gretchen [at] invalid.corn> wrote in message
news:5mvm8dFf1n88U1 [at] mid.individual.net...
> In news:mxdOi.10101$Cj1.9185 [at] edtnps90,
> Darryl Bach <dbach [at] seaside.ns.ca> wrote:
>
>> Not sure what to do with this, how can I determine what is trying to
>> mail to what program?
>>
>> <|paula [at] abc.ns.ca>... Cannot mail directly to programs: 12 Time(s)
>
> One often sees this message when the alias or mail directive specifies a
> program, rather than piping to the program. e.g.:
>
> address: /usr/bin/someprogram
>
> results in the above error, while
>
> address: "| /usr/bin/someprogram"
>
> works as expected.
>
Darryl Bach [ Do, 11 Oktober 2007 22:15 ] [ ID #1842979 ]
Miscellaneous » comp.mail.sendmail » From logwatch, is this a common entry

Vorheriges Thema: ctladdr
Nächstes Thema: did not issue MAIL/EXPN/VRFY/ETRN