[CentOS] Apparent bug in logwatch's reporting of number of email by sendmail

[Blake Hudson]

ken wrote on 3/13/2015 11:36 AM:
> # rpm -q sendmail logwatch
> sendmail-8.13.8-8.1.el5_7
> logwatch-7.3-10.el5
>
> One host sends just one email per day, the daily logwatch report. 
> Here's /var/log/maillog entries from yesterday (hostnames are changed 
> to make designations in this conversation more intuitive):
>
> Mar 12 04:02:18 srchost sendmail[27151]: t2C82Bjr027151: from=root, 
> size=2485, class=0, nrcpts=1, 
> msgid=<201503120802.t2C82Bjr027151 at localhost.localdomain>, 
> relay=root at localhost
> Mar 12 04:02:19 srchost sendmail[27383]: t2C82IiB027383: 
> from=<root at localhost.localdomain>, size=2756, class=0, nrcpts=1, 
> msgid=<201503120802.t2C82Bjr027151 at localhost.localdomain>, 
> proto=ESMTP, daemon=MTA, relay=srchost [127.0.0.1]
> Mar 12 04:02:19 srchost sendmail[27151]: t2C82Bjr027151: 
> to=recip at dest, ctladdr=root (0/0), delay=00:00:08, xdelay=00:00:01, 
> mailer=relay, pri=32485, relay=[127.0.0.1] [127.0.0.1], dsn=2.0.0, 
> stat=Sent (t2C82IiB027383 Message accepted for delivery)
> Mar 12 04:02:20 srchost sendmail[27385]: t2C82IiB027383: 
> to=<recip at dest.com>, ctladdr=<root at localhost.localdomain> (0/0), 
> delay=00:00:01, xdelay=00:00:01, mailer=esmtp, pri=122756, 
> relay=dellap.mousecar.net. [192.168.0.26], dsn=2.0.0, stat=Sent 
> (t2C82Jh3016227 Message accepted for delivery)
> Mar 13 04:02:13 srchost sendmail[30541]: t2D82ATM030541: from=root, 
> size=2589, class=0, nrcpts=1, 
> msgid=<201503130802.t2D82ATM030541 at localhost.localdomain>, 
> relay=root at localhost
>
> These four lines describe the sending of just one email.  (The 
> loglevel for sendmail is set at 9, the default.)  I don't know why, 
> but logwatch reports that two emails were sent yesterday. Could it be 
> because there are two distinct msgids?
> Here's the relevant section of the logwatch report:
>
> --------------------- sendmail Begin ------------------------
>
>  STATISTICS
>  ----------
>
>  Bytes Transferred:      5241
>  Messages Processed:     2
>  Addressed Recipients:   2
>
>  ---------------------- sendmail End -------------------------
>
> I'd also like to know where/how logwatch is getting the number for 
> "Bytes Transferred"; it doesn't seem to correspond to anything.
>
> So, unless I'm missing something, that's two problems.  Does anyone 
> see any others...?  or have a plausible explanation for these 
> inconsistencies?
>
> tia.

Ken, the bytes transferred looks to be the size of the first two log 
entries (2485 + 2756 = 5241). I'm not sure what logwatch considers 
individual messages in its sendmail stats, but a unique message ID does 
indicate a unique message. I also want to point out that if your 
logwatch is generating an email, this may be counted in the stats also 
(how, I'm not sure). If logwatch is running at 4AM, when these emails 
are being sent, I could also anticipate some problems, depending on the 
timing involved and when log entries are committed to the log. Overall, 
I wouldn't be concerned.

--Blake