sendmail issue - alias database automatically rebuilt

[Debbie Fleith]

Does anyone know what would cause my alias database to be re-built automatically by root?

We had a strange mail delivery problem and then found the alias file at zero bytes. No one with root access cleared this out, and then I saw this in the mailllog:

alias database /etc/aliases autorebuilt by root

What process would check that the alias file was changed and then run the "newalias" command automatically?

[Rick Garland]

Could be a 'newalias' command or the 'sendmail -bi' command. Either way, the commands do not run automatically by default - would need to invoke them manually or put in cron (or something similar).

Was the sendmail daemon stopped/started? This could do it.

But it was working on a 0 byte alias file. Was there any info in the alias file?

[Steven E. Protter]

Shalom Debbie,

It could a newalias command.

But it does not happen by itself. There is a script or cron job doing it.

find / -exec grep -l newalias {} \;

That will give you a list of suspects. Check it against cron and other scripts and you may be on the road to finding it.

Problem here is the alias file is set to zero bytes. The newalias command rebuilds sendmail databases based on /etc/aliases.

Something else hammered the /etc/aliases file.

Possible causes:
1) cron script, find command above could be modified to find the culprit.
2) root filesystem got full. On some HP-Ux releases important files can get zeroed out when this happens.

SEP