dead.letter file found in /home/nagios

[PhilG]

Hello:
We are using Nagios XI 5.4.13 on Red Hat Enterprise Linux Server release 6.5 (Santiago).
I am identifying disk space usage issues on root (/) and found stuff I can clean up in "/store/backups/mysql/", but am trying to figure out why this file exists in "home/nagios" (1.1 Gb file size):
-rw------- 1 nagios users 1099233433 Nov 5 14:10 dead.letter

Is this configured within Nagios or ??

I bet I have to stop Nagios, and probably Sendmail, to gzip the file up and store it offline. Thoughts?

Thank you in advance for your assistance.


UPDATE:
I have found the following in "/var/log/maillog":
"
lNov 5 14:32:51 <NAGIOS_SERVER> sendmail[5797]: wA5KWpjK005797: from=<nagios@<NAGIOS_SERVER_DNS>>, size=490, class=0, nrcpts=0, proto=ESMTP, daemon=MTA, relay=localhost.localdomain [127.0.0.1]

Nov 5 14:40:47 <NAGIOS_SERVER> sendmail[11967]: wA5KekVg011967: from=nagios, size=473, class=0, nrcpts=1, msgid=<201811052040.wA5KekVg011967@<NAGIOS_SERVER_DNS>>, relay=nagios@localhost

Nov 5 14:40:47 <NAGIOS_SERVER> sendmail[11971]: wA5KelkR011971: <$@<NAGIOS_SERVER_DNS>>... User unknown
"

Where is this configured??

[tgriep]

When ever some process tried to send an email and Sendmail cannot send it, it will put it in the dead.letter file.
Take a look at the bottom 100 lines or so of the file to determine what is generating the email, fix that and then you can delete the dead.letter file.
Run this to view the bottom 100 lines

Code: Select all

tail -100 dead.letter

[PhilG]

"
Received: (from nagios@localhost)
by <NAGIOS_SERVER> (8.14.4/8.14.4/Submit) id wA5LBhpI003078
for $;
"

The thing is, I do not know where this is configured, especially since my Nagios XI "System Config - Manage Email Settings" (https://<EDITED>/nagiosxi/admin/mailsettings.php) is configured using an Active Directory Domain "service" account to send out to our SMTP relay e-mail server, and that is working with no issues.


UPDATE:
The contact "nagiosadmin" has e-mail address "nagios@localhost". This is setup by default upon installation.

[tgriep]

There is not much details on where that email came from but it could be generated from a cron job.
We would have to see more of the message to help.
But, you can delete that file to free up some space.

[PhilG]

There is not much details on where that email came from but it could be generated from a cron job.
We would have to see more of the message to help.
But, you can delete that file to free up some space.

No cronjobs running on that server. However, I do have to turn back on the daily rename logs.

This appears to be a process where anytime a warning or critical issue is identified, the nagiosadmin appears to send an e-mail to the localhost. WHY?? Is there somewhere to turn this off? All my Hosts and Services are configured to send an e-mail to a specific User/Contact, none of which is localhost or nagios@localhost or "$". This is a Nagios/Nagios XI thing that needs an answer since I, the customer, haven't configured it. Thank you.

[tgriep]

Login to the XI GUI and go to the Admin > Manage Users menu and check all of the user accounts to see if the email address is valid for the user accounts.
First one to check is the nagiosadmin account.
Another place is to look at the Admin > Manage Email settings and verify that the From address its set correctly.

[PhilG]

Login to the XI GUI and go to the Admin > Manage Users menu and check all of the user accounts to see if the email address is valid for the user accounts.
First one to check is the nagiosadmin account.
Another place is to look at the Admin > Manage Email settings and verify that the From address its set correctly.

In "Admin > Manage Users" the "nagiosadmin" account is configured to use an Active Directory "service" account e-mail address/mailbox which is configured in our Active Directory/Office 365 environment. The other 26 Nagios XI users are configured either using Active Directory accounts with correct e-mail addresses or a local Nagios XI account using an Active Directory/Office 365 e-mail address, correctly configured.

As mentioned before, as per "look at the Admin > Manage Email":
"...especially since my Nagios XI "System Config - Manage Email Settings" (https://<EDITED>/nagiosxi/admin/mailsettings.php) is configured using an Active Directory Domain "service" account to send out to our SMTP relay e-mail server, and that is working with no issues."


As per "UPDATE:
The contact "nagiosadmin" has e-mail address "nagios@localhost". This is setup by default upon installation.", perhaps this is the culprit??

[tgriep]

During installation, it prompts you to add a email address for the nagiosadmin account which should update the contact as well. Was this step missed?

[PhilG]

During installation, it prompts you to add a email address for the nagiosadmin account which should update the contact as well. Was this step missed?

Well, I can try and reach out to the original SysAdmin who installed this back in 2013/2014, but retired about 2 years ago, and ask him if he remembers, but I don't think it's going to help. I am going to say with confidence that he left the default value when he installed the initial original version. When I was informed that I was taking over setting up the environment I at least modified the nagios "user" account back at that time, but not the "contact".

I will modify the nagios "contact" and then monitor.

I suspect that this post can then be froze.

Thank you!