what cause the root sending a message to oracle

[Hanry Zhou]

oracle user receives the message saying something like error in alert_instancename.log, and it was sent out by "root@servername.xx.com".

I checked the cron job, and can find anythign there sending the message.

Where else I can check out?

[Sridhar Bhaskarla]

Hi,

If it is not coming from the cronjobs (look at /var/adm/cron/log file for errors) then
looks like you have a monitoring tool like VPO that is scanning the log files and sending the messages as root.

-Sri

[Hanry Zhou]

No, by the sender's email address, I can tell that it is not sent by VPO, otherwise, it would have differetn sender's email specifically used by VPO.

[Steven E. Protter]

Sounds like its root on aonther box.

It could be somenoe trying to relay mail off hyour mail server. Check the mail.log file for trouble.

SEP

[Hanry Zhou]

the message was sent out by the application box.

Where is the mail.log located?

[Jeff Schussele]

Hi Hanry,

/var/adm/syslog/mail.log

Rgds,
Jeff

[Hanry Zhou]

Steven,

I did find the mail.log, but don't know how to locate the particular mail sending the message, who is the originator, and which script/commands sending the message?

I read the mail.log, and there is iterm about msgid=<20034455.WAA08934@servername.xx.com>,
what is that, and how do I find out the message associated with the msgid?

Thanks!

[Sridhar Bhaskarla]

Hi Henry,

You can get the msgid from the mail that you received. If you are reading it through outlook, you can look at the message headers by selecting the message options.

Do a "grep WAA08934 /var/adm/syslog/mail.log" You will get the details of this particular message.
However, you will not get the details on what script is sending these messages.

-Sri

[Michael Schulte zur Sur]

Hi,

what crontab have you checked, root?
Is servername.xx.com the same machine?

greetings,

Michael

[Hanry Zhou]

I check the root crontab on the server called "servername.xx.com".

[Hanry Zhou]

In mail.log, I find a line:
Jan 20 22:10:30 servername sendmail[9353]: WAA09839: to=oracle@xx.com, ctladdr=root, delay=00:00:01, xdelay=00:00:01, mailer=relay, relay=mailhost.xx.com state-sent (2.5.0 Ok.)

I suspect this is the line relates what I'm looking for, but how to trace it down to find out what script associating the line message?

Is Steven(SEP) out there?

[Michael Schulte zur Sur]

Hi again.

have you checked the crontab of root? How often do you receive the messages? In regular intervals? The script in question may also be started manually. Brute force would be a search though all scripts for sendmail and mail.

Michael

[Hanry Zhou]

Steven(SEP),

You were probably pointing to me the right direction by checking out mail.log file, and I did find some Clue from it, but what I should do next? How do I find out the source of sending this email, which script/command?

Please let me know.

[Michael Schulte zur Sur]

Hi,

you can't see from the mail.log, if and what script created this mail. Have you checked the scripts from user root?

Michael

[Hanry Zhou]

Michael,

There are a few lines in mail.log, indicating the message "to:", "from:", "relay:", and a serious number of "msgid", as well as the time, but I could figure out what I want from the line, who and how the message was sent.

it's not in cron job, root scripts? that is what I want to find out, which script/command. I have aleady tried everything you have suggested. So, now I just want to more focus on the mail as Steven suggested.

I believe, these lines in mail.log are assoicated with emails, but where I can find out more information?