spooled outgoing mail

UltramaticOrange · 04-24-2006, 10:24 AM

I've accidently mailbombed myself...

.
.
.

If you're done laughing, could someone tell me where mail is spooled under SuSE 10.0? `/var/spool/mail` does not appear to be it even though the (empty) directory exsists.

My goal is to do something like:

Code:

root@linux# rm -f /var/spool/mail/<user>

and put an end to the nonsense.

gilead · 04-24-2006, 03:11 PM

/var/spool/maill is where delivered mail is spooled (for sendmail anyway) - do you want the directory where mail is waiting to be sent? I'm not sure what you sent the mail with - do you have either of the directories /var/spool/clientmqueue or /var/spool/mqueue?

UltramaticOrange · 04-25-2006, 09:06 AM

Hey gilead, thanks for the help.

The mail was sent using PHP's mail function. If I get a chance when I'm off work, I'll check those directories.

Edit: I just remembered that I did go through all the likely directories in /var/spool and didn't find anything. I belive this included mqueue.

UltramaticOrange · 04-25-2006, 03:50 PM

Alternativly, is there a naming convention (sendmail) for outgoing spooled mail? If so, I could just

Code:

find / -name file_name*

or somesuch.

gilead · 04-25-2006, 05:18 PM

Sendmail does generate spooled mail with its own naming scheme - but I think it uses some randomness and varies from system. For example, after stopping sendmail on one of my boxes here and trying to send mail using the mail command, my /var/spool/clientmqueue directory contains files called dfk3PMG5d9012189 and qfk3PMG5d9012189

UltramaticOrange · 04-25-2006, 05:30 PM

I've found 'dfk*' and 'qfk*' as part of the file names while searching around elsewhere. I also thought to check the sendmail config files to see where messages are queued.

gilead · 04-25-2006, 07:38 PM

It may work (but would be slow) to grep the files below /var/spool for strings that are in the emails that you're getting. For example, if one of them has a subject containing "pay rise" (wishful thinking on my part):

Code:

grep -ir 'pay rise' /var/spool/*

UltramaticOrange · 04-25-2006, 08:43 PM

`/var/spool/postfix/deferred`

I ended up running

Code:

grep -ir 'MOTheD :: Seen it!' /var/spool/* 2> /dev/null

and found it right away. I'm doing one last check to make sure I didn't miss anything.

Thanks for the help.

gilead · 04-25-2006, 09:17 PM

That's good news - congratulations