serverlog emails sent to wrong address

[tinodesigns]

Hi,

I noticed in my email delivery report that a lot of my servlog emails are marked as delivered but are not saved or available on the server. I think it is due to a wrong set delivery email.

The log emails are sent by [email protected],servername.com which is correct and fine. Then the delivery event details give me this info on receipient and delivered to:

Recipient:	[email protected]
Delivered To:	[email protected]

Now if it was sent to root, it should end up in the mailbox account for [email protected] not [email protected]. The later does not exist. I assume that is why they can't be located or saved by the system. Trying to open the message from the delivery report gives me the error:
"The system failed to locate the message with Message ID “xxxxxxxxxx”. The system may have deleted the message: The address “[email protected]” is not local to this server. "

Under "Edit System Mail Preferences" a forwarder from root to [email protected] is setup and it seems to work perfectly fine with other log emails, i.e. the ones I get from lfd.

There are currently a couple of hundred log mails a day that I can't see but need to, in order to figure out what's going on on the server. Server seems fine but I need those either way.

Does anyone know where to fix that deliverbility issue? Mails are reported as being delivered but they are nowhere to be found on the server.

Thanks,
Tino

 

[cPRex]

Hey there! Is this the main server contact email in WHM >> Basic WebHost Manager Setup? That would be the most likely place where that is configured.

 

[tinodesigns]

That mail ( Basic WebHost Manager Setup ) is set to be [email protected] which would be correct. But emails are going to [email protected].

 

[cPRex]

Are these cPanel notifications? If so, can you point out a specific notification where this is happening?

 

[tinodesigns]

I think it is WHM but I'm unsure since I'm not able to get the email. All infos I have are:

Event:	success
Sender User:	root
Sender Domain:
From Address:	[email protected]
Sender:	root
Sent Time:	Oct 24, 2022, 6:53:18 PM
Sender Host:	localhost
Sender IP:	127.0.0.1
Authentication:	localuser
Spam Score:
Recipient:	[email protected]
Delivered To:	[email protected]host.serverdomain.com
Delivery User:	serverlog
Delivery Domain:
Router:	virtual_user
Transport:	dovecot_virtual_delivery
Out Time:	Oct 24, 2022, 6:53:18 PM
ID:	1on0hs-xxxxxx-Hz
Delivery Host:	localhost
Delivery IP:	127.0.0.1
Size:	1.15 KB
Result:	Accepted

However the mails are nowhere found. and [email protected]host.serverdomain.com does not exist.

 

[tinodesigns]

I'm trying to figure out what exactly is sending these.

Is it possible to setup [email protected]host.serverdomain.com somehow maybe be able to receive those? Also why don't they bounce back?

 

[cPRex]

Thanks for that information - can you run this command on the server to get the full email transaction so we can see where this is coming from?

grep 1on0hs-xxxxxx-Hz /var/log/exim_mainlog

 

[tinodesigns]

Thanks a lot for that command, it seems to be lfd as well. (Couldn't post the output here, getting an posting error but I was abel to find it that way.


When I started this thread earlier I cleaned out the [email protected] email domain. The mails I just searched for can now be found. So it seems the mailbox was most likely full and not accepting all new mails?

Anyway I think I'll be able to figure this out now using the command you gave me.I can get the emails through the mailbox directly now. Seem to be mainly lfd blocks.

Thanks a lot,
Tino

 

[cPRex]

I'm glad that helped to point you in the right direction!