Take the 2-minute tour ×
Ask Different is a question and answer site for power users of Apple hardware and software. It's 100% free, no registration required.

I'm new to OSX Server, and this has me stumped. For some reason _www user is emailing itself every minute.

I've tried to restrict it in postfix config, both sending & receiving, i've removed _www as the user from apache. From the email below is seems to be cron generated, but I dont know how to find the job.

Any help would be greatly appreciated.

The email is:

Return-Path: <_www@mail.mydomainname.id.au>
Delivered-To: _www@mail.mydomainname.id.au
Received: from localhost (localhost [127.0.0.1])
by mail.mydomainname.id.au (Postfix) with ESMTP id 1A28F2405596
for <_www@mail.mydomainname.id.au>; Sat, 17 May 2014 12:04:01 +1000 (EST)
X-Virus-Scanned: amavisd-new at mail.mydomainname.id.au
Received: from mail.mydomainname.id.au ([127.0.0.1])
by localhost (mydomainname.id.au [127.0.0.1]) (amavisd-new, port 10024)
with ESMTP id CtqSyJmASaym for <_www@mail.mydomainname.id.au>;
Sat, 17 May 2014 12:04:00 +1000 (EST)
Received: by mail.mydomainname.id.au (Postfix, from userid 70)
id E9EE9240558C; Sat, 17 May 2014 12:04:00 +1000 (EST)
From: _www@mail.mydomainname.id.au (Cron Daemon)
To: _www@mail.mydomainname.id.au
Subject: Cron <_www@mydomainname> sh /tmp/sess_f652da7dd28dce7baeeae54a46ae4099
X-Cron-Env: <SHELL=/bin/sh>
X-Cron-Env: <PATH=/usr/bin:/bin>
X-Cron-Env: <LOGNAME=_www>
X-Cron-Env: <USER=_www>
X-Cron-Env: <HOME=/Library/WebServer>
Message-Id: <20140517020400.E9EE9240558C@mail.mydomainname.id.au>
Date: Sat, 17 May 2014 12:04:00 +1000 (EST)
sh: /tmp/sess_f652da7dd28dce7baeeae54a46ae4099: No such file or directory*

SMTP log says:

May 17 12:04:00 mydomainname.id.au postfix/pickup[58709]: E9EE9240558C: uid=70 from=<_www>
May 17 12:04:00 mydomainname.id.au postfix/cleanup[58801]: E9EE9240558C: message-id=<20140517020400.E9EE9240558C@mail.mydomainname.id.au>
May 17 12:04:00 mydomainname.id.au postfix/cleanup[58801]: warning: recipient _www uid falls below minimum allowed: 70 < 501
May 17 12:04:00 mydomainname.id.au postfix/qmgr[58710]: E9EE9240558C: from=<_www@mail.mydomainname.id.au>, size=600, nrcpt=1 (queue active)
May 17 12:04:01 mydomainname.id.au postfix/smtpd[58896]: connect from localhost[127.0.0.1]
May 17 12:04:01 mydomainname.id.au postfix/smtpd[58896]: warning: recipient _www uid falls below minimum allowed: 70 < 501
May 17 12:04:01 mydomainname.id.au postfix/smtpd[58896]: 1A28F2405596: client=localhost[127.0.0.1]
May 17 12:04:01 mydomainname.id.au postfix/cleanup[58801]: warning: recipient _www uid falls below minimum allowed: 70 < 501
May 17 12:04:01 mydomainname.id.au postfix/cleanup[58801]: 1A28F2405596: message-id=<20140517020400.E9EE9240558C@mail.mydomainname.id.au>
May 17 12:04:01 mydomainname.id.au postfix/qmgr[58710]: 1A28F2405596: from=<_www@mail.mydomainname.id.au>, size=1046, nrcpt=1 (queue active)
May 17 12:04:01 mydomainname.id.au postfix/smtpd[58896]: disconnect from localhost[127.0.0.1]
May 17 12:04:01 mydomainname.id.au postfix/smtp[58806]: E9EE9240558C: to=<_www@mail.mydomainname.id.au>, orig_to=<_www>, relay=127.0.0.1[127.0.0.1]:10024, delay=0.17, delays=0.01/0/0.01/0.15, dsn=2.0.0, status=sent (250 2.0.0 from MTA(smtp:[127.0.0.1]:10025): 250 2.0.0 Ok: queued as 1A28F2405596)
May 17 12:04:01 mydomainname.id.au postfix/qmgr[58710]: E9EE9240558C: removed
May 17 12:04:01 mydomainname.id.au postfix/pipe[58812]: 1A28F2405596: to=<_www@mail.mydomainname.id.au>, relay=dovecot, delay=0.06, delays=0.01/0/0/0.05, dsn=2.0.0, status=sent (delivered via dovecot service)
May 17 12:04:01 mydomainname.id.au postfix/qmgr[58710]: 1A28F2405596: removed
share|improve this question
    
After MANY hours over the last few days, I've found the problem ... just not sure how it got there. It seems that there was a 'crontab' for _www user that was attempting to do this "sh /tmp/sess_f652da7dd28dce7baeeae54a46ae4099". The file doesn't exist, so it failed & emailed. Any ideas what would cause this ??? –  user78374 May 17 at 11:10

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.