suddenly 'User unknown'?

Shaw, Brian bshaw at vsvinc.com
Thu Nov 29 14:34:47 EST 2018 

   It looks like you may have some type of disk permissions issue.

Nov 29 18:36:51 dell2600-1 sendmail[5070]: wATIapgq005070: Losing
./qfwATIapgq005070: savemail panic
Nov 29 18:36:51 dell2600-1 sendmail[5070]: wATIapgq005070: SYSERR(root):
savemail: cannot save rejected email anywhere

   This may be the cause of your "user unknown" error.  Either way, you 
shouldn't have errors like this.

Brian

On 2018-11-29 2:00 pm, Charles Bradshaw via Info-cyrus wrote:
> Simon
> 
> My original post contained a dump of /var/log/maillog, butwas asked by
> Dan "what does cyrus syslog say" so assumed there should be some more
> log messages somewhere.
> 
> For the record I do: Clear /var/log/maillog then send a test email from
> the command line. Then /var/log/maillog contains:
> 
> Nov 29 18:36:51 dell2600-1 sendmail[5067]: wATIapoE005067: from=brad,
> size=44, class=0, nrcpts=1,
> msgid=<201811291836.wATIapoE005067 at bradcan.homelinux.com>,
> relay=brad at localhost
> Nov 29 18:36:51 dell2600-1 sendmail[5068]: NOQUEUE: connect from
> localhost.localdomain [127.0.0.1]
> Nov 29 18:36:51 dell2600-1 sendmail[5068]: AUTH: available 
> mech=CRAM-MD5
> DIGEST-MD5, allowed mech=EXTERNAL DIGEST-MD5 CRAM-MD5
> Nov 29 18:36:51 dell2600-1 sendmail[5068]: wATIapgq005068: Milter: no
> active filter
> Nov 29 18:36:51 dell2600-1 sendmail[5068]: STARTTLS=server,
> relay=localhost.localdomain [127.0.0.1], version=TLSv1/SSLv3, 
> verify=NO,
> cipher=DHE-RSA-AES256-GCM-SHA384, bits=256/256
> Nov 29 18:36:51 dell2600-1 sendmail[5068]: STARTTLS=server,
> cert-subject=, cert-issuer=, verifymsg=ok
> Nov 29 18:36:51 dell2600-1 sendmail[5068]: AUTH: available 
> mech=CRAM-MD5
> DIGEST-MD5, allowed mech=EXTERNAL DIGEST-MD5 CRAM-MD5
> Nov 29 18:36:51 dell2600-1 sendmail[5067]: STARTTLS=client,
> relay=[127.0.0.1], version=TLSv1/SSLv3, verify=FAIL,
> cipher=DHE-RSA-AES256-GCM-SHA384, bits=256/256
> Nov 29 18:36:51 dell2600-1 sendmail[5068]: ruleset=trust_auth,
> arg1=brad at bradcan.homelinux.com, relay=localhost.localdomain
> [127.0.0.1], reject=550 5.7.1 <brad at bradcan.homelinux.com>... not
> authenticated
> Nov 29 18:36:51 dell2600-1 sendmail[5068]: wATIapgr005068:
> from=<brad at bradcan.homelinux.com>, size=358, class=0, nrcpts=1,
> msgid=<201811291836.wATIapoE005067 at bradcan.homelinux.com>, proto=ESMTP,
> daemon=MTA, relay=localhost.localdomain [127.0.0.1]
> Nov 29 18:36:51 dell2600-1 sendmail[5070]: AUTH=client, 
> relay=localhost,
> mech=, bits=0
> Nov 29 18:36:51 dell2600-1 sendmail[5070]: wATIapgr005068:
> to=<brad at bradcan.homelinux.com>, delay=00:00:00, xdelay=00:00:00,
> mailer=cyrusv2, pri=120358, relay=localhost, dsn=5.1.1, stat=User 
> unknown
> Nov 29 18:36:51 dell2600-1 sendmail[5070]: wATIapgr005068:
> wATIapgq005070: DSN: User unknown
> Nov 29 18:36:51 dell2600-1 sendmail[5067]: wATIapoE005067:
> to=brad at bradcan.homelinux.com, ctladdr=brad (500/500), delay=00:00:00,
> xdelay=00:00:00, mailer=relay, pri=30044, relay=[127.0.0.1] 
> [127.0.0.1],
> dsn=2.0.0, stat=Sent (wATIapgr005068 Message accepted for delivery)
> Nov 29 18:36:51 dell2600-1 sendmail[5070]: wATIapgq005070:
> to=<brad at bradcan.homelinux.com>, delay=00:00:00, xdelay=00:00:00,
> mailer=cyrusv2, pri=31677, relay=localhost [[UNIX:
> /var/lib/imap/socket/lmtp]], dsn=5.1.1, stat=User unknown
> 
> NOTE: The following is to be expected because both root and postmaster
> are aliased to brad at bradcan.homelinux.com
> 
> Nov 29 18:36:51 dell2600-1 sendmail[5070]: wATIapgq005070: alias
> MAILER-DAEMON => postmaster
> Nov 29 18:36:51 dell2600-1 sendmail[5070]: wATIapgq005070: alias
> postmaster => root
> Nov 29 18:36:51 dell2600-1 sendmail[5070]: wATIapgq005070: alias root 
> =>
> brad at bradcan.homelinux.com
> Nov 29 18:36:51 dell2600-1 sendmail[5070]: wATIapgq005070: alias
> postmaster => root
> Nov 29 18:36:51 dell2600-1 sendmail[5070]: wATIapgq005070: alias root 
> =>
> brad at bradcan.homelinux.com
> Nov 29 18:36:51 dell2600-1 sendmail[5070]: wATIapgq005070:
> wATIapgr005070: return to sender: User unknown
> Nov 29 18:36:51 dell2600-1 sendmail[5070]: wATIapgr005070:
> to=brad at bradcan.homelinux.com, delay=00:00:00, xdelay=00:00:00,
> mailer=cyrusv2, pri=32701, relay=localhost [[UNIX:
> /var/lib/imap/socket/lmtp]], dsn=5.1.1, stat=User unknown
> Nov 29 18:36:51 dell2600-1 sendmail[5070]: wATIapgr005070: alias
> MAILER-DAEMON => postmaster
> Nov 29 18:36:51 dell2600-1 sendmail[5070]: wATIapgr005070: alias
> postmaster => root
> Nov 29 18:36:51 dell2600-1 sendmail[5070]: wATIapgr005070: alias root 
> =>
> brad at bradcan.homelinux.com
> Nov 29 18:36:51 dell2600-1 sendmail[5070]: wATIapgr005070: done;
> delay=00:00:00, ntries=1
> Nov 29 18:36:51 dell2600-1 sendmail[5070]: wATIapgq005070: Losing
> ./qfwATIapgq005070: savemail panic
> Nov 29 18:36:51 dell2600-1 sendmail[5070]: wATIapgq005070: 
> SYSERR(root):
> savemail: cannot save rejected email anywhere
> Nov 29 18:36:51 dell2600-1 sendmail[5070]: wATIapgq005070: done;
> delay=00:00:00, ntries=1
> Nov 29 18:36:52 dell2600-1 sendmail[5070]: wATIapgr005068: done;
> delay=00:00:01, ntries=1
> 
> That's the entire content.
> 
> Now you tell me is cyrus syslog being sent to /var/log/maillog? Or
> should it be going to /var/imapd.log as the configuration files, man
> pages and cyrus installation guides ( found here:
> https://www.cyrusimap.org/imap/installing.html ) say it should?
> 
> I originally asked for an explanation of the mechanism (IE. sequence of
> events) lmtp uses to decide stat = 'User unknown" or not. But I seem to
> be getting deeper and deeper into where the logs are going rather than
> understanding the process.
> 
> On 29/11/2018 17:55, Simon Matter wrote:
>>> Dan
>>> 
>>> I have, and have always had, an empty /var/log/imapd.log so I'm not
>>> going to make progress until I fix that.
>>> 
>>> In n /etc/rsyslog.conf
>>> 
>>> # cyrus imapd
>>> #local6.*                              /var/log/imapd.log   - tried 
>>> this
>>> first.
>>> local6.debug                        /var/log/imapd.log
>>> auth.debug                          /var/log/auth.log
>>> 
>>> and in /etc/imapd.conf
>>> 
>>> syslog_prefix: cyrus
>>> syslog_facility: LOCAL6
>>> 
>>> If I remove the file /etc/imapd.log then
>>> 
>>> # /etc/init.d/rsyslog restart
>>> 
>>> # logger local6.debug 'test log message'
>>> 
>>> # cat /var/log/imapd.log
>>> 
>>> Nov 29 15:06:42 dell2600-1 brad: test log message
>>> 
>>> Obviously syslog is working local6. But still no messages from cyrus!
>>> Therefor I'm now stuck with this secondary problem.
>>> 
>>> I have followed the cyrus instructions as best I can, but no go. I 
>>> say
>>> again this has all worked for years, albeit with an always empty 
>>> imapd.log
>>> 
>>> There must be some missing cyrus syslog configuration.
>> From README.RPM in the cyrus-imapd package:
>> 12) Check your syslog configuration. This RPM uses the mail facility 
>> to log
>>     messages. On busy sites you may want to limit the mail facility to 
>> the
>>     info priority with something like 'mail.info    /var/log/maillog' 
>> in
>>     /etc/syslog.conf.
>> 
>> So, I guess your cyrus-imapd messages go to /var/log/maillog then, 
>> not?
>> 
>> Regards,
>> Simon
>> 
> ----
> Cyrus Home Page: http://www.cyrusimap.org/
> List Archives/Info: http://lists.andrew.cmu.edu/pipermail/info-cyrus/
> To Unsubscribe:
> https://lists.andrew.cmu.edu/mailman/listinfo/info-cyrus

More information about the Info-cyrus mailing list