I had a problem where an application server that periodically checks a pop3 mailbox could not read a message (different format than expected).

Consequently the mailbox filled up. I tried to delete the 1st message in the mailbox, but when quiting the "mail" command, the os threw a segment fault. I decided I would save off the mail file and create a new one and deal with the backed up messages later.

I stopped sendmail with "sendmail stop".

[This is a redhat 7.3 machine, and 8.11 sendmail.]

Then I waited for all the sendmail daemons to disappear from the process list.

Then I did a cp and rm to the mail file.

However, even with sendmail stopped, the mailbox continued to fill up with mail.

I am trying to figure out what process continued to fill the mailbox, even with sendmail completely stopped.

Is it the LDA...procmail?

Is there something that empties the mail queue that is not sendmail?

I have also read that the files in /var/mail are hard links to /var/spool/mail. Was it just rebuilding the file from /var/spool/mail?

Right now there are also what look like "temp" files in both /var/spool/mail and /var/mail left over from the time when the problem occurred. They look like "_ZZH*.MYSERVER.MYDOMAIN.COM". What are these files? Can they be recovered?

Do you have a fetchmail running, maybe ?

I do not see fetchmail in the process list.

And according to my sendmail.cf file, procmail is my LTA.

But since procmail is run from within sendmail (I think) and sendmail was stopped...I don't see how procmail could have been running and putting messages in the mail file either...

There should be something in your mail logs telling you whats being delivered, and presumably, by what.

btw, RH7.3 is so old you can't have had any security updates in years and really need to upgrade