no mail from / for root

[Steve Phillips]

j_70 at comcast.net wrote:
> I guess the curiosity here is that:
> 
> [root at rhel1 root]$ ps -aeef | grep mail
> root   19005 18945  0 20:23 pts/0    00:00:00 grep mail
> [root at rhel1 root]$
> [root at rhel1 root]$ ps -aeef | grep master
> root   19081 18945  0 20:24 pts/0    00:00:00 grep master
> [root at rhel1 root]$
> 
> Yet root has 123 messages. Where are they being served-up from????

That depends on a number of things - firstly what mail server is running 
(if any) and if no server is running, how the host has been setup to 
submit mail. The old version of sendmail simply checked to see if mail 
was local and wrote it directly to the local user mbox (/var/spool/mail) 
- this all changed a wee while back (redhat 9 i believe, may have been 
FC1|[AE]S3 tho) and used an SMTP submission system that would still 
allow you to submit mail with /bin/mail even if you were running 
something like postfix/qmail/etc that delivered to a different location 
or format.

To find out, you need to first see if you are listening on port 25, to 
do this try

netstat -an | grep LIST | grep :25

The output should look something like..

[root at wibble steve]# netstat -an | grep LIST | grep :25
tcp        0      0 0.0.0.0:25                  0.0.0.0:* 
     LISTEN

where the first set of 0.0.0.0s is your local address, this may be an IP 
(127.0.0.1 or your external IP) as well.

This tells you that there is something listening on port 25, from here 
we can find out what it is, under linux, you can pass netstat the -p 
flag that tells it to query the /proc filesystem to tell you which 
process is doing the listening, issue the following.

netstat -anp | grep LIST | grep :25

The output should look something like..

[root at wibble steve]# netstat -anp | grep LIST | grep :25
tcp        0      0 0.0.0.0:25                  0.0.0.0:* 
     LISTEN      10169/tcpserver

Here we can see on my box we are running a program called "tcpserver" 
which is listening for inbound port 25 connections (SMTP) - in my case, 
tcpserver is set to call qmail-smtpd which then looks after reciving 
mail, yours may be something different.

you can also check out /var/log/messages and _usually_ /var/log/maillog 
as well to see if there is any mail activity, this will also let you 
know whats going on with the mail subsystem and should be the first port 
of call when investigating "weirdness"

HTH,

-- 
Steve.