Error mail from Cron Daemon

thomasdk81

Verified User
Joined
Oct 3, 2010
Messages
56
Location
Denmark
Hi guys,

I've got Exim, ESF, Blockcracking, SA etc. setup via custombuild.
Recently I began getting mails with errors from the Cron Daemon.

Contents of the mail is: "exim abandoned: unknown, malformed, or incomplete option -"
Yes there is no flag, just a hyphen at the end.

The mail subject is: "Cron <root@server5> /usr/sbin/csf --rbl [email protected]"

I can't find where this cmd is set.
Anybody?

Cheers,
Thomas
 
Hello Thomas,

What do you see with:

Code:
grep csf /etc/cron* /var/spool/* -R --color
?
 
Sorry didn't get a notification, so didn't see your reply.

Code:
[root@server5 ~]# grep csf /etc/cron* /var/spool/* -R --color
/etc/cron.d/csf_update:12 2 * * * root /usr/sbin/csf -u
/etc/cron.d/csf-cron:@daily root /usr/sbin/csf --rbl [email protected]
/etc/cron.d/lfd-cron:0 0 * * * root /usr/sbin/csf --lfd restart > /dev/null 2>&1
/var/spool/exim/input/1YnwUz-0000HO-6E-D:Apr 30 23:25:02 server5 lfd[19354]: (sshd) Failed SSH login from 96.10.107.162 (US/United States/rrcs-96-10-107-162.se.biz.rr.com): 5 in the last 300 secs - *Blocked in csf* [LF_SSHD]
/var/spool/exim/input/1YnwUz-0000HO-6E-D:Apr 30 23:46:10 server5 lfd[26531]: (sshd) Failed SSH login from 87.106.176.38 (DE/Germany/s15283632.onlinehome-server.info): 5 in the last 300 secs - *Blocked in csf* [LF_SSHD]
/var/spool/exim/input/x/1c5Zzx-00086j-OD-D:XOzMu4gZeTh9Mf4OraEX3WbM8YkxUdcmiAcsfL+GWY5HXo/VoTqkv6wR5xVaHdhxp2THnhjjAH08
/var/spool/exim/input/x/1c5Zzx-00086j-OD-D:9jfdrOumuqe3BossFz62OsboHloLh8DylanhcFjcsfV+u4B7S27Q/wDB1gtnj93/AHrYw2Np+tGS
/var/spool/exim/input/x/1c5Zzx-00086j-OD-D:rl+p2P37Xc913teP6r4csfruNhtcPWIEmUd2MitXijExKZ3iZK6ijAxL5NDWuA78q/jYNFfFbZ76
/var/spool/exim/input/x/1c5Zzx-00086j-OD-D:w9mkSI5Tmq8ANDXNHmnfW97QCwyE0xleyjSNzfdD/ojUEeKDc70zLXbu7R8UcsfEFplBtxnvc0bT
/var/spool/exim/input/x/1c5Zzx-00086j-OD-D:X82D4pjtzQlqWvrsLgZTPK5IOmcsf0BqmyXWN9wC0WimE9s6zQiw6XcRjsZ04r/9ei6rXx4uYJub
/var/spool/exim/input/1Y4HNx-0001G8-Ex-D:Dec 25 23:29:30 server5 lfd[31220]: *Port Scan* detected from 107.182.167.3 (US/United States/107-182-167-3.static.webnx.com). 11 hits in the last 85 seconds - *Blocked in csf* for 3600 secs [PS_LIMIT]
/var/spool/exim/input/1Wrtti-00084p-8P-D:csfWpfA3h6+tNSTV7wPa2cUJlDkj94pHT6Y5/KvdwDUKUkujf5I4a9JzrqK2MrS/Ces3uqrbXFtd
/var/spool/exim/input/1Wrtti-00084p-8P-D:3F0OYuupGcI00sP4ayPtp0xzWwLTUTvvrF0/csfDhGvGmmbvCI2S//Hg84RC2Ym6flYjPhq1A5St
/var/spool/exim/input/1X3x0W-0007wc-IJ-D:--------------csf1404693688
/var/spool/exim/input/1X3x0W-0007wc-IJ-D:--------------csf1404693688
/var/spool/exim/input/1X3x0W-0007wc-IJ-D:--------------csf1404693688
/var/spool/exim/input/1X3x0W-0007wc-IJ-D:--------------csf1404693688
/var/spool/exim/input/1X3x0W-0007wc-IJ-D:--------------csf1404693688--
/var/spool/exim/input/1WzRmu-0004a6-Dc-D:sowFnZfPNnjYYY+Mn8Jhdzl5FyNSMZybF53xknHmb9csfW5S3YxByRsmLJx/
/var/spool/exim/input/H/1ZPcYH-0001tF-RW-D:csfl6YNXIr8zKgi/djGM9/Qc1xQvbmaUrH8g4BGO/r71ZW6nacRqQD7VyUcNiHJc2xuoo6dL
/var/spool/exim/input/H/1ZPcYH-0001tF-RW-D:9ncliucsfX2rF0vSOszHDDk49K4XaSu2ejh72O703UUig89jiVeNqjP4n1JFd9YXT3BSMP8A
/var/spool/exim/input/H/1ZPcYH-0001tF-RW-D:MrRRKsb4J7/Xv+FefxSpszMvnZGV3e3rXqVMsgqaqJa9z9CynFycFFvYcsfmFmH3l7+pqTUZ
/var/spool/exim/input/H/1ZPcYH-0001tF-RW-D:XNfjj4ztlh1aSFg3+scKCMKNpwW9csf5V+2WqRxXmnTRA5JBHH8Xt+NfkZ8ZtBez8VTWocIw
/var/spool/exim/input/H/1ZPcYH-0001tF-RW-D:xbZ9DuIlkKptJznB45H/ANeufM5NJcp9Zk0kr82x+c3iKcCdkUFiCcsf5V53JChd5skgnHWv
/var/spool/exim/input/H/1ZPcYH-0001tF-RW-D:252+/tVe4A8gBGw7c1DAyxvvJ6DHNeLUR2KSLcWdm1hjbVlcsfmGAPWstr7qijoe/HFPF0zx
/var/spool/exim/input/H/1ZPcYH-0001tF-RW-D:Rl5+bGcsfrjpUOhN6WMY4yF9z9ALD4hk/KFx3+YA8e+K6K2+IKBSkpRtgznBGQeOO2a+DtE+
/var/spool/exim/input/H/1ZPcYH-0001tF-RW-D:mqP2m4acsfmTBzTp5t7q0eAen4UkuCX+znAx+ZHet8TG8U0LDTV7WNzTb+MR7UwvqfX2r0HS
/var/spool/exim/input/H/1ZPcYH-0001tF-RW-D:cTUcPcsffUIvc+4POVSvHJ7dKFJTOOD39KidGGX/AIkPH+NR+aQ21xww5IrzZO56MKZcEi8A
/var/spool/exim/input/H/1ZPcYH-0001tF-RW-D:2rNlubcsfJLYA78DPvWTBcq52SHBHAYn8hzVS7uSd6gYOcY6/nXHWoSnJWOqNNRgaUpSMlx8
/var/spool/exim/input/H/1ZPcYH-0001tF-RW-D:TxyzRK2csfT+HFTO4CxK4wUY59aimlxuWIbR74oVfsdrjoRWsTxxbJQATnPOR9fyq0saSYhI
/var/spool/exim/input/H/1ZPcYH-0001tF-RW-D:LucXt7LthZCjxKM85+8P8OataqHlBksYfmjy7ZyQcc9un4VpXeppbIipEI0j68csfUfXv71i
/var/spool/exim/input/H/1ZPcYH-0001tF-RW-D:xo24tJgtGxU+n+TUkqRqm7JweOR/KnrJHuMaDBAI/Pr+tVd9vtSKQBFRto7csfX3P5munke5
/var/spool/exim/input/H/1ZPcYH-0001tF-RW-D:JKmqMnIGxcsfv44z6c1oi4eCDKRmXaeecYz/ACqN2SZT5OAc5I7+9ek+VRvIyl7pErxxPj73
/var/spool/exim/input/H/1ZPcYH-0001tF-RW-D:OoPX86hjSCP5mcsf6VZ80iBgpG3sPU9q6KVK7sjy5fEVTJHLnYOnGPp1qvEvkSM4GV7E/rQl
/var/spool/exim/input/H/1ZPcYH-0001tF-RW-D:5Ef8LEnBIHqSetc0KVndoUtHcsfZV1+WOZlaJYslWYkfL0OR0YAjg4+lMuYpbN18tNzocqc4
/var/spool/exim/input/H/1ZPcYH-0001tF-RW-D:yAQccsfbt/hWvuFo4kUncfywegqlf+fK48w7t4yAegH8vrXLQ1dnsYUaSlL3hkVykcAKfef7
/var/spool/exim/input/H/1ZPcYH-0001tF-RW-D:mfkN7+nPT2NL6sp63OWUU3ckRnafcw+Ve3QGofLupLh4o03Bmxtxge9S75pdsY/dsmcsf5Ae
/var/spool/exim/input/H/1ZPcYH-0001tF-RW-D:SaTOunTSV0bEM1nb2slvOFUvIrM6ZLEKMbeucd8DFYcsfmzvGW3Rh22Muc4z8p6ZyfpXSaDp
/var/spool/exim/input/H/1ZPcYH-0001tF-RW-D:Vx1RafayIEcsfyP41cuLaOSJfMOQuCWUYJOOeOw/GqiTrHIrL8o6Ennj6fyoecmACM7VOflx
/var/spool/exim/input/H/1ZPcYH-0001tF-RW-D:QQOrFc5z2HFeLQX2pswispgr4LOT1bccsfqSc59ea9HEYSnJJPU+cyOmrym9y1dPG8U0U43O
/var/spool/exim/input/H/1ZPcYH-0001tF-RW-D:Syj5vl/XA9K05eUGr7FZG3b2QMyJ12gkAdiT2+lYtvOzvKrgcsfn/wBjsPzraivrqKCaxjLL
/var/spool/exim/input/H/1ZPcYH-0001tF-RW-D:7g+9XL2ET3scsf8ArCPmwOw75/PrUMlyn2g6fbkM6AFQTztHByT1Occ5471NHM8MmFQ/7WwZ
/var/spool/exim/input/H/1ZPcYH-0001tF-RW-D:qb/T9R8MacmqeMLqWKzumH+oBDyAfMTGo7DHGcDpzXM3mpw3tusWm25tLcj7mcsfqfU/xe+a
/var/spool/exim/input/H/1ZPcYH-0001tF-RW-D:hCO+9QMZ+nqfahZIlRJAN3csfWrcEADHeQAeQtUZZfNPy4ZM7Qo67vU/WtJVpSkuhjKny7Cs
/var/spool/exim/input/H/1ZPcYH-0001tF-RW-D:wP5fTmFtH8TpE7m3LjIVRuHTOD36Y/GuPEc0XZl1INaMvXUu62CRLuJPUcsfbPbGa0RBa6RG
/var/spool/exim/input/H/1ZPcYH-0001tF-RW-D:LGJ0fbxj7xHH51opHdGOlzVlmgKeSgzxyKSyjWKTzM7sjgdqy1Vkcsf4sAH+tTia2hYRsNwU
/var/spool/exim/input/H/1ZPcYH-0001tF-RW-D:MtO1m1mYxwBSGztwaL+U7dpGRG+bG3VqgqnSqD/T6wYy0qlu1gLlD4nAlcsfNNF2f93vTGUP
/var/spool/exim/scan/1ZPcYH-0001tF-RW/1ZPcYH-0001tF-RW.eml:csfl6YNXIr8zKgi/djGM9/Qc1xQvbmaUrH8g4BGO/r71ZW6nacRqQD7VyUcNiHJc2xuoo6dL
Binary file /var/spool/exim/db/callout matches
 
So its the --rbl thats not vaild?
I havn't customized anything in CSF or Custombuild.
I'll try and find where in CSF this cron is set.

- Thomas
 
I've never seen this before... so it seems to be something on your side only.
 
Back
Top