[comp.sys.sun] sendmail on the attack

rrb@mathsun.math.wayne.edu (Robert Bruner) (10/07/89)

Our file server and mail handler was down for two days last weekend
because of a tripped circuit breaker.  After I brought it back up, two of
the clients started sending messages to the postmaster (me) once per hour
that I do not understand.  Here is a sample:

[---------------- begin included message----------------------------------]

Date:    Thu, 15 Jun 89 09:40:57 EDT
X-Subject: Returned mail: Unable to deliver mail
Message-Id: <.AA08448@klein.math.wayne.edu>
From:    MAILER-DAEMON (Mail Delivery Subsystem)

  ----- Transcript of session is unavailable -----

  ----- No message was collected -----

------------------ end included message ----------------------------------

The date at which the client (klein) claims to have received this
apparently empty message is the date and time of klein's last reboot.
Similarly for the other client.  On both, the directory /usr/spool/mqueue
is empty.  Neither has any uucp connections.  Neither sent these messages
out before the crash and reboot of the server.  They occur once per hour
because rc.local invokes sendmail with the  -q1h option.   (This is how I
deduced that sendmail was at fault.)  When I killed and restarted sendmail
this behaviour went away.

So, in a sense the problem is solved, but I hate not knowing what was
going on.  Any clues as  to what sendmail thought it was doing?

Setup:  clients 3/50's, server 3/260, SunOS3.5, sendmail that comes with
3.5, /usr/spool/mail -> /usr/local2/spool/mail, which is NFS mounted on
all clients (the symbolic link is to a file system which has more room and
is mounted rw), all users aliased to user@server.

I finally killed both offending sendmails because I was tired of deleting
the messages from my mailbox, so I can't examine them in action.