1

I have started running rkhunter (a security monitoring tool) and I have finally managed to clear all of its warnings.

Now, a cron job runs every day to monitor my machine. Rather than send me an email of warnings, it sends me an email with no body - which I don't really want.

Looking at the (unedited, straight out of the box) /etc/cron.daily/rkhunter script, it contains this snippet of shell code:

    if [ -s "$OUTFILE" ]; then
      (
        echo "Subject: [rkhunter] $(hostname -f) - Daily report"
        echo "To: $REPORT_EMAIL"
        echo ""
        cat $OUTFILE
      ) | /usr/sbin/sendmail $REPORT_EMAIL
    fi

The -s clause should prevent empty emails from being sent, right? Does anyone have an explanation why this would still send empty emails?

2
  • Are you sure it is the script, and not cron, that emails you? What is the subject of the empty emails you receive?
    – geirha
    Feb 28, 2011 at 9:15
  • @geirha: I think you are on the right track. Make it an answer so I can vote you up! The email address is "rkhunter on <servername> - <serveripaddress>". Note it does NOT contain "Daily Report", so it is coming from somewhere else. Doesn't mention cron, though. Feb 28, 2011 at 11:20

1 Answer 1

1

Given your additional information in the comments. That script is apparently not the one sending you that email, since the subjects do not match.

Does the empty mail come daily, at approximately the same time each day? (and if so, when?) I'd go to look for other cronjobs running rkhunter. Perhaps an older version of the package installed a different cronjob, and that this didn't get replaced properly by a newer version.

Firstly, see if there are other jobs running rkhunter in cron.daily.

grep -F rkhunter /etc/cron.daily/*

Next place I'd look is in all the different crontabs. First, the user crontabs, look for jobs running at approximately the time you get those emails (man 5 crontab explains the format).

crontab -l      # lists your user's crontab
sudo crontab -l # lists root's crontab

Next, the system crontab:

cat /etc/crontab /etc/cron.d/*

Cron logs to syslog as well, so you could look for lines containing CRON in /var/log/syslog as well.

1
  • This set me straight. As well as the cron.daily script, there was another explicit crontab entry running rkhunter and sending its output (unconditionally) to email. I had completely forgotten I had added that (I still have no memory of it!) and have nothing in my configuration notes for that machine - naughty me. Thank you for your help. Feb 28, 2011 at 21:45

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .