Take the 2-minute tour ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free, no registration required.

I have started running rkhunter (a security monitoring tool) and I have finally managed to clear all of its warnings.

Now, a cron job runs every day to monitor my machine. Rather than send me an email of warnings, it sends me an email with no body - which I don't really want.

Looking at the (unedited, straight out of the box) /etc/cron.daily/rkhunter script, it contains this snippet of shell code:

    if [ -s "$OUTFILE" ]; then
      (
        echo "Subject: [rkhunter] $(hostname -f) - Daily report"
        echo "To: $REPORT_EMAIL"
        echo ""
        cat $OUTFILE
      ) | /usr/sbin/sendmail $REPORT_EMAIL
    fi

The -s clause should prevent empty emails from being sent, right? Does anyone have an explanation why this would still send empty emails?

share|improve this question
    
Are you sure it is the script, and not cron, that emails you? What is the subject of the empty emails you receive? –  geirha Feb 28 '11 at 9:15
    
@geirha: I think you are on the right track. Make it an answer so I can vote you up! The email address is "rkhunter on <servername> - <serveripaddress>". Note it does NOT contain "Daily Report", so it is coming from somewhere else. Doesn't mention cron, though. –  Oddthinking Feb 28 '11 at 11:20

1 Answer 1

up vote 1 down vote accepted

Given your additional information in the comments. That script is apparently not the one sending you that email, since the subjects do not match.

Does the empty mail come daily, at approximately the same time each day? (and if so, when?) I'd go to look for other cronjobs running rkhunter. Perhaps an older version of the package installed a different cronjob, and that this didn't get replaced properly by a newer version.

Firstly, see if there are other jobs running rkhunter in cron.daily.

grep -F rkhunter /etc/cron.daily/*

Next place I'd look is in all the different crontabs. First, the user crontabs, look for jobs running at approximately the time you get those emails (man 5 crontab explains the format).

crontab -l      # lists your user's crontab
sudo crontab -l # lists root's crontab

Next, the system crontab:

cat /etc/crontab /etc/cron.d/*

Cron logs to syslog as well, so you could look for lines containing CRON in /var/log/syslog as well.

share|improve this answer
    
This set me straight. As well as the cron.daily script, there was another explicit crontab entry running rkhunter and sending its output (unconditionally) to email. I had completely forgotten I had added that (I still have no memory of it!) and have nothing in my configuration notes for that machine - naughty me. Thank you for your help. –  Oddthinking Feb 28 '11 at 21:45

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.