Tired from emails from error_log

7 posts / 0 new
Last post
#1 Wed, 08/06/2014 - 07:34
hermes101

Tired from emails from error_log

Hi guys, im not sure is it right place to ask my issue, but I'll try... Im very tired from messages from server like this:

Return-Path: <example.adm@xxxxx.xxx.lt>
Received: by xxxxx.xxx.lt (Postfix, from userid 1001)
     id 0C531874171; Sat,  2 Aug 2014 01:38:40 +0300 (EEST)
To: error@example.lt
Subject: Example.lt Error Page
From: error@example.lt
Message-Id: <20140801223841.0C531874171@xxxxx.xxx.lt>
Date: Sat,  2 Aug 2014 01:38:40 +0300 (EEST)

Sat Aug 2 2014 1:38:40 am EEST

24.61.229.132 tried to load 213.190.51.54/HNAP1/

User Agent = Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.0.1) Gecko/2008092215 Firefox/3.0.1 Orca/1.1 beta 3

http://XXX.XXX.XXX.XXX/

I want to stop messaging this errors. I tried to find where is coniguration to send errors by email, but no luck. Google didnt help too... Where this configuration can be??? Thank you in advance...

Wed, 08/06/2014 - 08:38
Locutus

I've never seen this kind of email before. It looks like some kind of warning from a web server. It's certainly nothing that Virtualmin would set up by default to be sent.

Can you elaborate a bit more, who gets these emails where, when and from whom, and what's in the respective mail.log when a delivery is done?

Thu, 08/07/2014 - 04:02
hermes101

Its nothing strange there... its only part of Apache Error Log (/var/log/virtualmin/example.lt_error_log), like I noticed it is only posting [ERROR]'s from this log... But I cant find out where it configured... Will try answer to ur question: who gets these emails where, when and from whom admin gets this emails with "Undelivered Mail Returned to Sender" (U can see it in msg: Return-Path: example.adm@xxxxx.xxx.lt) because error@example.lt ("example.lt" I changed) not exist but like u can see in msg it addressed "To: error@example.lt", sender is "From: error@example.lt". It comes at the same time when error log appeared. what's in the respective mail.log when a delivery is done

Aug  2 01:38:41 xxxxx postfix/pickup[14519]: 0C531874171: uid=1001 from=<example.adm>
Aug  2 01:38:41 xxxxx postfix/cleanup[17894]: 0C531874171: message-id=<20140801223841.0C531874171@xxxxx.xxx.lt>
Aug  2 01:38:41 xxxxx postfix/qmgr[16536]: 0C531874171: from=<example.adm@xxxxx.xxx.lt>, size=525, nrcpt=1 (queue active)
Aug  2 01:38:41 xxxxx postfix/error[18634]: 0C531874171: to=<error@example.lt>, relay=none, delay=0.22, delays=0.17/0/0/0.05, dsn=5.0.0, status=bounced (User unknown in virtual alias table)
Aug  2 01:38:41 xxxxx postfix/cleanup[17894]: 24FCE874172: message-id=<20140801223841.24FCE874172@xxxxx.xxx.lt>
Aug  2 01:38:41 xxxxx postfix/bounce[18635]: 0C531874171: sender non-delivery notification: 24FCE874172
Aug  2 01:38:41 xxxxx postfix/qmgr[16536]: 24FCE874172: from=<>, size=2253, nrcpt=1 (queue active)
Aug  2 01:38:41 xxxxx postfix/qmgr[16536]: 0C531874171: removed
Aug  2 01:38:41 xxxxx postfix/cleanup[17894]: 31570874122: message-id=<20140801223841.24FCE874172@xxxxx.xxx.lt>
Aug  2 01:38:41 xxxxx postfix/local[7009]: 24FCE874172: to=<example.adm@xxxxx.xxx.lt>, relay=local, delay=0.09, delays=0.05/0/0/0.04, dsn=2.0.0, status=sent (forwarded as 31570874122)
Aug  2 01:38:41 xxxxx postfix/qmgr[16536]: 31570874122: from=<>, size=2386, nrcpt=1 (queue active)
Aug  2 01:38:41 xxxxx postfix/qmgr[16536]: 24FCE874172: removed
Aug  2 01:38:41 xxxxx postfix/local[8537]: 31570874122: to=<server.admin-xxx.lt@xxxxx.xxx.lt>, orig_to=<example.adm@xxxxx.xxx.lt>, relay=local, delay=0.55, delays=0.04/0/0/0.51, dsn=2.0.0, status=sent (delivered to command: /usr/bin/procmail-wrapper -o -a $DOMAIN -d $LOGNAME)
Aug  2 01:38:41 xxxxx postfix/qmgr[16536]: 31570874122: removed

hope now more clearly ;-)

Thu, 08/07/2014 - 10:00
andreychek

Howdy,

Like locutus, I've never heard of that occurring before.

However, looking at the received headers of your email above, the email is being generated by the user with the userid "1001".

That suggests to me that either that user has something in cron that's doing that, or it's being done via something in the website itself.

-Eric

Thu, 08/07/2014 - 14:41
Locutus

Yeah, like Eric I'd suspect that one of your users (ID 1001) set up a script or similar to be informed about errors in their Apache log, and set it up incorrectly, with a non-existent (example) sender/recipient address, so you're receiving the non-deliverable messages.

I'm not aware that Apache would have such a function to email out log errors, and it's definitely nothing that Virtualmin would set up by default.

Fri, 08/08/2014 - 01:02
hermes101

Thank you guys, now at least I know that its nothing that VM would set up... Will try to find info somewhere in Apache forum... and reply if something find out...

Wed, 08/13/2014 - 02:11
hermes101

after hard googling I found direction where to search... First tip was that it must be php script, second - it must be somewhere in /home/example.adm/public_html voila! There is folder "Error" and several files. One of them error.php. Made some observation and found code in it:

</head>
<body>
<div class="codeblock"><pre><code><span style="color: #000000"><span style="color: #0000BB"><?php<br /> </span><span style="color: #007700">&</span><span style="color: #FF8000">#10;&#10;$ip = getenv (&quot;REMOTE_ADDR&quot;); &#10;&#10;$requri = getenv (&quot;REQUEST_URI&quot;); &#10;$servname = getenv (&quot;SERVER_NAME&quot;); &#10;$combine = $ip . &quot; tried to load &quot; . $servname . $requri ; &#10;&#10;$httpref = getenv (&quot;HTTP_REFERER&quot;); &#10;$httpagent = getenv (&quot;HTTP_USER_AGENT&quot;);&#10;&#10;$today = date(&quot;D M j Y g:i:s a T&quot;); &#10;&#10;$message = &quot;$today \n &#10;&lt;br&gt; &#10;$combine &lt;br&gt; \n &#10;User Agent = $httpagent \n &#10;&lt;h2&gt; $note &lt;/h2&gt;\n &#10;&lt;br&gt; $httpref &quot;; &#10;&#10;$message2 = &quot;$today \n &#10;$combine \n &#10;User Agent = $httpagent \n &#10;$httpref &quot;; &#10;&#10;$to = &quot;error@example.lt&quot;; &#10;$subject = &quot;Example.lt Error Page&quot;; &#10;$from = &quot;From: error@example.lt\r\n&quot;; &#10;&#10;mail($to, $subject, $message2, $from); &#10;&#10;// echo $message; &#10;<br /></span><span style="color: #0000BB">?></span></span></code></pre></div>
    <div id="page">
        <div id="header" class="header">
            <h1>ERROR 404: PAGE NOT FOUND</h1>
        </div>
        <div id="content">
        <br />
        <br />
            <h2></h2>
            <p class="centeredImage"><a href="http://example.lt"> <img src="/error/error.png" border="0" align="center"> </a></p>
            <br />
            <br />
            <h2>some kind of text</h2>
        <br />
 
        </div>
        <div id="footer">
        &copy; 2011 <a href="http://example.lt">example.lt</a>
        </div>
    </div>
</body>
</html>

Hope it will be useful to someone. Sorry for off-topic... there is nothing with Virtualmin...

Topic locked