Im attempting to parse some sendmail logs. Im running into lots of apparent emails that have no recipients – or so it would appear.
Mar 18 19:12:35 castor sendmail[543]: q2J2CYIv000543: from=<paj@otech.org>, size=0, class=0, nrcpts=1, proto=ESMTP, daemon=MTA-SSL, relay=somehost.net [6.7.36.178]
Mar 18 19:12:35 castor sendmail[543]: q2J2CYIw000543: from=<paj@otech.org>, size=0, class=0, nrcpts=0, proto=ESMTP, daemon=MTA-SSL, relay=somehost.net [6.7.36.178]
Mar 18 19:12:35 castor sendmail[543]: q2J2CYIx000543: from=<paj@otech.org>, size=0, class=0, nrcpts=0, proto=ESMTP, daemon=MTA-SSL, relay=somehost.net [6.7.36.178]
Mar 18 19:12:35 castor sendmail[543]: q2J2CYJ0000543: from=<paj@otech.org>, size=0, class=0, nrcpts=0, proto=ESMTP, daemon=MTA-SSL, relay=somehost.net [6.7.36.178]
Mar 18 19:12:35 castor sendmail[543]: q2J2CYJ1000543: from=<paj@otech.org>, size=0, class=0, nrcpts=0, proto=ESMTP, daemon=MTA-SSL, relay=somehost.net [6.7.36.178]
Mar 18 19:12:35 castor sendmail[543]: q2J2CYJ2000543: from=<paj@otech.org>, size=0, class=0, nrcpts=0, proto=ESMTP, daemon=MTA-SSL, relay=somehost.net [76.27.206.178]
First – it look like these are all from the same PID (543) yet one has 'nrcpts=1' while the rest are zero.
Second – all are 'size=0'
What do these lines indicate? Searching the log doesn't show any other reference to this PID (or whatever it is).
Best Answer
nrcpts=0
means that the mail was temporarily rejected right after the MAIL FROM: command at the SMTP dialog.