Strange syslog messages

Jørn Dahl-Stamnes

unread,

Jan 2, 2007, 9:04:39 AM1/2/07

to

The following text was generated by logwatch when
analyzing /var/log/maillog:

l01Hs58h017693: l01IJ3hJ020471: postmaster notify: User unknown
l01IJ3hJ020471: l01IJ3hK020471: return to sender: User unknown
l01IJ3hJ020471: Losing ./qfl01IJ3hJ020471: savemail panic
l01IJ3hJ020471: SYSERR(root): savemail: cannot save rejected email anywhere
l01I0cHb018314: l01IJ3hL020471: postmaster notify: User unknown
l01IJ3hL020471: l01IJ3hM020471: return to sender: User unknown
l01IJ3hL020471: Losing ./qfl01IJ3hL020471: savemail panic
l01IJ3hL020471: SYSERR(root): savemail: cannot save rejected email anywhere
l01Hsb2k017605: l01IJ3hN020471: postmaster notify: User unknown
l01IJ3hN020471: l01IJ3hO020471: return to sender: User unknown

I have never seen this before. Can someone please explain what causes this
messages? Anyhting I should be aware of?

--
Jørn Dahl-Stamnes
http://www.dahl-stamnes.net/dahls/

Andrzej Adam Filip

unread,

Jan 2, 2007, 9:20:10 AM1/2/07

to

Jørn Dahl-Stamnes <newsma...@REMOVEdahl-stamnes.net> writes:

Have you defined postmaster alias in aliases file?
[ in /etc/mail/ or /etc/ directory, run newaliases after modifications]

To test deliveries to postmaster use test command below:
sendmail -d27.2 -bv postmaster

--
[pl2en: Andrew] Andrzej Adam Filip : an...@priv.onet.pl : an...@xl.wp.pl
Before You Ask: http://anfi.homeunix.net/sendmail/B4UAsk-Sendmail.html
http://anfi.homeunix.net/sendmail/

Jørn Dahl-Stamnes

unread,

Jan 2, 2007, 10:34:45 AM1/2/07

to

Andrzej Adam Filip wrote:

> Jřrn Dahl-Stamnes <newsma...@REMOVEdahl-stamnes.net> writes:
>
>> The following text was generated by logwatch when
>> analyzing /var/log/maillog:
>>
>> l01Hs58h017693: l01IJ3hJ020471: postmaster notify: User unknown
>> l01IJ3hJ020471: l01IJ3hK020471: return to sender: User unknown
>> l01IJ3hJ020471: Losing ./qfl01IJ3hJ020471: savemail panic
>> l01IJ3hJ020471: SYSERR(root): savemail: cannot save rejected email
>> anywhere l01I0cHb018314: l01IJ3hL020471: postmaster notify: User unknown
>> l01IJ3hL020471: l01IJ3hM020471: return to sender: User unknown
>> l01IJ3hL020471: Losing ./qfl01IJ3hL020471: savemail panic
>> l01IJ3hL020471: SYSERR(root): savemail: cannot save rejected email
>> anywhere l01Hsb2k017605: l01IJ3hN020471: postmaster notify: User unknown
>> l01IJ3hN020471: l01IJ3hO020471: return to sender: User unknown
>>
>> I have never seen this before. Can someone please explain what causes
>> this messages? Anyhting I should be aware of?
>
> Have you defined postmaster alias in aliases file?

No, I have removed it to avoid spam messages. Before I removed it (which I
didt 2 years ago), I recieved 10-20 spams every day to postmaster@...

This is the first time I see this kinds of messages, even if the postmaster
alias has been disabled. I have never seen a "savemail panic" message
before.

--
Jřrn Dahl-Stamnes
http://www.dahl-stamnes.net/dahls/

Michael Heiming

unread,

Jan 3, 2007, 7:52:41 AM1/3/07

to

In comp.mail.sendmail J?rn Dahl-Stamnes <newsma...@removedahl-stamnes.net>:
> Andrzej Adam Filip wrote:
>> J?rn Dahl-Stamnes <newsma...@REMOVEdahl-stamnes.net> writes:

>>> The following text was generated by logwatch when
>>> analyzing /var/log/maillog:

>>> l01Hs58h017693: l01IJ3hJ020471: postmaster notify: User unknown
>>> l01IJ3hJ020471: l01IJ3hK020471: return to sender: User unknown
>>> l01IJ3hJ020471: Losing ./qfl01IJ3hJ020471: savemail panic
>>> l01IJ3hJ020471: SYSERR(root): savemail: cannot save rejected email

[..]

>> Have you defined postmaster alias in aliases file?

> No, I have removed it to avoid spam messages. Before I removed it (which I
> didt 2 years ago), I recieved 10-20 spams every day to postmaster@...

;(

Iirc this account is required by RFC. You will end up here, if
you aren't already:

http://www.rfc-ignorant.org/

--
Michael Heiming (X-PGP-Sig > GPG-Key ID: EDD27B94)
mail: echo zvp...@urvzvat.qr | perl -pe 'y/a-z/n-za-m/'
#bofh excuse 280: Traceroute says that there is a routing
problem in the backbone. It's not our problem.

Jørn Dahl-Stamnes

unread,

Jan 3, 2007, 9:15:16 AM1/3/07

to

Michael Heiming wrote:

> In comp.mail.sendmail J?rn Dahl-Stamnes
> <newsma...@removedahl-stamnes.net>:
>> Andrzej Adam Filip wrote:
>>> J?rn Dahl-Stamnes <newsma...@REMOVEdahl-stamnes.net> writes:
>
>>>> The following text was generated by logwatch when
>>>> analyzing /var/log/maillog:
>
>>>> l01Hs58h017693: l01IJ3hJ020471: postmaster notify: User unknown
>>>> l01IJ3hJ020471: l01IJ3hK020471: return to sender: User unknown
>>>> l01IJ3hJ020471: Losing ./qfl01IJ3hJ020471: savemail panic
>>>> l01IJ3hJ020471: SYSERR(root): savemail: cannot save rejected email
> [..]
>
>>> Have you defined postmaster alias in aliases file?
>
>> No, I have removed it to avoid spam messages. Before I removed it (which
>> I didt 2 years ago), I recieved 10-20 spams every day to postmaster@...
>
> ;(
>
> Iirc this account is required by RFC. You will end up here, if
> you aren't already:

Even if the postmaster is forwared to /dev/null? After all, the postmaster
account is loved by spammers...

Grant Taylor

unread,

Jan 3, 2007, 2:35:32 PM1/3/07

to

Jørn Dahl-Stamnes wrote:
> I have never seen this before. Can someone please explain what causes this
> messages? Anyhting I should be aware of?

This looks like syslog entries for a ""lost message. The message in
question is probably a bounce that turned in to a double bounce. Try
looking in to using "define(`confDOUBLE_BOUNCE_ADDRESS',
`us...@domain.tld')" to direct double bounces somewhere. If you do not
want to see double bounce notifications, route them to /dev/null. This
should help make Sendmail happier.

Grant. . . .

Neil W Rickert

unread,

Jan 3, 2007, 4:01:19 PM1/3/07

to

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

=?ISO-8859-1?Q?J=F8rn?= Dahl-Stamnes <newsma...@REMOVEdahl-stamnes.net> writes:
>Michael Heiming wrote:

>> Iirc this account is required by RFC. You will end up here, if
>> you aren't already:

>> http://www.rfc-ignorant.org/

>Even if the postmaster is forwared to /dev/null? After all, the postmaster
>account is loved by spammers...

It is better to forward postmaster to /dev/null than to not have a
postmaster email address.

I'm inclined to challenge your assertion "After all, the postmaster
account is loved by spammers..." Sure, the postmaster address
receives spam. But, at least on my systems, it receives far less
spam than do many regular addresses.

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.2 (GNU/Linux)

iD8DBQFFnBmYvmGe70vHPUMRAsMuAKDq47C8XXrKI1pBoo30BLuAnVEIdACgudFu
+brkedRtYk7hYvoNxu8HpkQ=
=Jt7d
-----END PGP SIGNATURE-----

Michael Heiming

unread,

Jan 3, 2007, 4:20:12 PM1/3/07

to

In comp.mail.sendmail J?rn Dahl-Stamnes <newsma...@removedahl-stamnes.net>:
> Michael Heiming wrote:

>> In comp.mail.sendmail J?rn Dahl-Stamnes
>> <newsma...@removedahl-stamnes.net>:
>>> Andrzej Adam Filip wrote:
>>>> J?rn Dahl-Stamnes <newsma...@REMOVEdahl-stamnes.net> writes:

[ no postmaster account? ]

>>>> Have you defined postmaster alias in aliases file?

>>> No, I have removed it to avoid spam messages. Before I removed it (which
>>> I didt 2 years ago), I recieved 10-20 spams every day to postmaster@...

>> ;(

>> Iirc this account is required by RFC. You will end up here, if
>> you aren't already:

> http://www.rfc-ignorant.org/

> Even if the postmaster is forwared to /dev/null? After all, the postmaster
> account is loved by spammers...

These days? I can hardly remember much if any spam to this
account lately, a couple of years ago I'd agreed with you.

--
Michael Heiming (X-PGP-Sig > GPG-Key ID: EDD27B94)
mail: echo zvp...@urvzvat.qr | perl -pe 'y/a-z/n-za-m/'

#bofh excuse 147: Party-bug in the Aloha protocol.

Jørn Dahl-Stamnes

unread,

Jan 4, 2007, 7:50:57 AM1/4/07

to

Michael Heiming wrote:

> In comp.mail.sendmail J?rn Dahl-Stamnes

>> Even if the postmaster is forwared to /dev/null? After all, the
>> postmaster account is loved by spammers...
>
> These days? I can hardly remember much if any spam to this
> account lately, a couple of years ago I'd agreed with you.

Yes, postmaster@, uucp@ and mail@ is the 3 most used adresses which the
spammers try to use, unless I shall count all spam messages that use a
faked non-existent from-adresses at my domain.

During 24 hours I can receive over 5000 messages to bettab<???>@ where <???>
is some random character. The bettab<???> is used in the from messages. The
source are mail relays all over the world. But some are worse than other,
like tnetmx.telefonica.net (spain).

David F. Skoll

unread,

Jan 4, 2007, 9:19:48 AM1/4/07

to

Jørn Dahl-Stamnes wrote:

> Yes, postmaster@, uucp@ and mail@ is the 3 most used adresses which the
> spammers try to use, unless I shall count all spam messages that use a
> faked non-existent from-adresses at my domain.

Really? I get hardly any spam to my postmaster@ address. Since Dec
31, I've had 45 attempted e-mail attempts to postmaster (daily mail
volume is typically a couple of thousand.) None of the postmaster e-mails
got through because *every single one* was stopped by greylisting.

In the same time frame, I had 928 attempts to my primary address
dfsATroaringpenguinDOTcom.

Regards,

David.

Michael Heiming

unread,

Jan 4, 2007, 11:47:03 AM1/4/07

to

In comp.mail.sendmail David F. Skoll <d...@roaringpenguin.com>:
> J?rn Dahl-Stamnes wrote:

Seconded, rechecking some logs there are about zero attempts to
deliver spam to postmaster accounts in weeks. It would although
be the most idiotic thing any spammer could do, chances aren't
that bad to piss of some people who will for sure hunt down the
IP and make it unusable for the spammer.

--
Michael Heiming (X-PGP-Sig > GPG-Key ID: EDD27B94)
mail: echo zvp...@urvzvat.qr | perl -pe 'y/a-z/n-za-m/'

#bofh excuse 236: Fanout dropping voltage too much, try cutting
some of those little traces

Jørn Dahl-Stamnes

unread,

Jan 5, 2007, 5:41:45 AM1/5/07

to

David F. Skoll wrote:

Compared to mails to non-existant addresses, the amount of spam to legal
addresses is none. This is the output of the logwatch for the last 24
hours:

I have no idea where the as*ls has got the bettab*** addresse from. There
has never been any account/e-mail addresses like it on my domain.

I also wonder the source of the *testing*@ addresses. Any kind of legal
test?