Cron daily report

Submitted by cyrus on Wed, 06/19/2019 - 15:32 Pro Licensee

Over the last couple of days, I have been receiving the following message and not my logwatch daily report. Kindly advise.

/etc/cron.daily/00logwatch:
postdrop: warning: uid=0: File too large
sendmail: fatal: root(0): message file too big
Status: 
Active

Comments

Submitted by andreychek on Wed, 06/19/2019 - 15:58

Howdy -- thanks for contacting us!

It sounds like there's an issue where an email that was too large tried to be sent via Postfix.

That generated a notice in the logs, and then the nightly logwatch notified you about that.

It's safe to ignore, unless one of your users is telling you they're having trouble sending an email. But it may also be a bot trying to send a message to one of your users.

Submitted by Blueforce on Wed, 06/19/2019 - 18:03 Pro Licensee

Hi Eric,

I think he is asking about why he is receiving the message he posted instead of the daily Logwatch report.

Best regards, Leffe

Submitted by andreychek on Wed, 06/19/2019 - 18:26

Hmm, it initially looked like that was part of the logwatch report since it's being generated during the logwatch cron job.

However, if you're saying that you're expecting something different (I don't get logwatch reports, so I'm not sure what they look like) -- the other possibility is that the logwatch report is so large that it was unable to email it to you.

You could try running the logwatch cron job from the command line to see what output it produces there.

Submitted by cyrus on Fri, 06/21/2019 - 17:23 Pro Licensee

root@host:~# /usr/sbin/logwatch --mailto me@myaddress.com --format text
postdrop: warning: uid=0: File too large
sendmail: fatal: root(0): message file too big
root@host:~#

Submitted by andreychek on Sat, 06/22/2019 - 09:32

It sounds like there's just too much information it's trying to send.

If you want to see what all is in the report, you could use the --print option, which would allow you to see the report from the command line.

If you're able to determine what's in the report that's causing it to be so large, the next report to run could be much smaller.

The only way you'd be able to send that current report via email though would be to increase the "message_size_limit" in your /etc/postfix/main.cf file.