Logwatch email failing with "invalid sender domain"

Question

I run logwatch manually (no cron job). I use nullmailer to send emails from the server using my ISP's SMTP server. I can send test emails from command line no problem. But logwatch is using a bad "From" address that causes my ISP to reject the email, and I can't find the setting to change.

In my logwatch config file I have MailFrom = me@gmail.com. The first lines of the email generated by logwatch look like this:

root@myserverhostname.gmail.com
me@timewarnercable.com

Received: (nullmailer pid 5939 invoked by uid 0);
    Sun, 25 Sep 2016 15:25:02 -0000
To: me@timewarnercable.com
From: root@gmail.com
Subject: Logwatch for myserverhostname (Linux)

Notice that the address in first line of the file has myserverhostname inserted into it. Unfortunately, this seems to be the address that is really used. The domain on the From: line is correct, and would work, except that it changed my username to root. The To: line and the 2nd line of the file match.

Note: the From: address is not exactly what is shown in the logwatch config file. I specified MailFrom = me@gmail.com and it shows up in the From as root@gmail.com. It appears that the config file settings for logwatch are being overridden somewhere.

How can I stop logwatch from inserting myserverhostname into the From address and changing my name to root?

Edit: relevant portion of logwatch.conf

# Default person to mail reports to.  Can be a local account or a
# complete email address.  Variable Output should be set to mail, or
# --output mail should be passed on command line to enable mail feature.
MailTo = me@timewarnercable.com
# WHen using option --multiemail, it is possible to specify a different
# email recipient per host processed.  For example, to send the report
# for hostname host1 to user@example.com, use:
#Mailto_host1 = user@example.com
# Multiple recipients can be specified by separating them with a space.

# Default person to mail reports from.  Can be a local account or a
# complete email address.
MailFrom = me@gmail.com

The error from mail.log

Sep 25 11:15:52 myserverhostname nullmailer[10724]: smtp: Failed: 550 5.1.0 <root@myserverhostname.gmail.com> sender rejected : invalid sender domain

Bottom line When logwatch generates the email, it is not using the value I supplied in the MailFrom line of the config file.

On MailFrom, I supplied me@gmail.com but it used root@myserverhostname.gmail.com in the first line of the email, and root@gmail.com in the From: line of the email. I need it to say me@gmail.com in the first line at least. If I manually edit the email and replace that line, it sends just fine.

I use logwatch, and I'd like to help, but your problem description is so hard to follow because of the pseudo names, and the description. Please edit your problem description to try and simplify/clarify the problem, and please include the mailto and mailfrom, from your config file. Cheers, Al — heynnema, Sep 25 '16 at 22:18
Thanks for your willingness to help. I will try and clarify. But I don't think it's a good idea to post my real addresses. — Organic Marble, Sep 25 '16 at 22:27
I tried to summarize the problem in the Bottom Line section of the question. Thanks again. — Organic Marble, Sep 25 '16 at 22:40
I agree... just change the myisp and the adifferentisp etc. And, I think the solution might be to set your mailfrom=logwatch, and let logwatch append the localhost name to it, and your ISP's mail server probably won't complain. My config is mailfrom=logwatch, mailto=root, and root has a .forward with the local address of my normal logged in account. Then I have Thunderbird collect my local mail from my local mailbox. The ISP never gets involved. Cheers, Al — heynnema, Sep 25 '16 at 22:43
Thanks. I replaced with some isps that I don't use. I don't have thunderbird on this server, instead I use nullmailer as the MTA. I will research this .forward, I have not heard of that. — Organic Marble, Sep 25 '16 at 22:48
Your ISP is choking because logwatch is sending a from that contains its domain, and no such machine exists. Changing your mailfrom=logwatch, your ISP should get a mail from logwatch@yourlocalhostname.local, and then not complain. Cheers, Al — heynnema, Sep 25 '16 at 22:50
Didn't it generate logwatch@myserverhostname.localdomain? Cheers, Al off to recheck my emails from logwatch... Question: how do you check your root mail on the server? — heynnema, Sep 25 '16 at 23:01
check http://serverfault.com/questions/774716/logwatch-is-not-respecting-mailfrom — heynnema, Sep 25 '16 at 23:23
and http://serverfault.com/questions/280379/how-to-change-sender-field-in-the-header-of-logwatch-emails — heynnema, Sep 25 '16 at 23:26
I even hacked logwatch.pl to specify the from field, and it still happens. It must be nullmailer causing the problem. — Organic Marble, Sep 26 '16 at 00:59
On my AWS EC2 Ubuntu I had all these issues and nothing worked until I found /etc/mailname and changed that with the correct FQDN and it then worked. — Keith Pawson, Feb 12 '19 at 23:59

score 1 · Accepted Answer · answered Sep 26 '16 at 01:13

Many thanks to heynnema for his helpful suggestions. He pointed me to the 2nd configuration file which could be modified to fix the problem.

This turned out not to be a problem with logwatch, or nullmailer, but with sendmail itself. It was sendmail that was ignoring the inputs from the logwatch config file and inserting its own value of the From address.

Fortunately, the /user/share/logwatch/dist.conf/logwatch.conf file has a line

mailer = "/usr/sbin/sendmail -t"

I was able to force the correct From address by changing this to read

mailer = "/usr/sbin/sendmail -t -f me@gmail.com"

Logwatch email failing with "invalid sender domain"

1 Answers1