What is the "You have new mail" message in Linux/UNIX?

Question

Sometimes, when I log into a box and 'su' to root, I get a cute little message saying I have mail (thank GOD it's not AOL).

Where is this mail?
What does it contain?
Who/What sent it?
How important is it?

Is this even actual "mail" in the same sense as email? Or is it just my system telling me something?

EDIT: In relation to this question, would I be able to send myself mail using the sendmail program like so: email@localhost?

I have this one message in there that says "This text is part of the internal format of your mail folder,..." so of course whenever I log in I am informed that I have mail. — GEdgar, Jul 04 '11 at 20:38
@GEdgar: This usually means you should stop using *mbox* mailboxes and migrate to *Maildir* :) — u1686_grawity, Jul 04 '11 at 21:12
Related: http://superuser.com/questions/149282/safely-get-rid-of-you-have-new-mail-in-var-mail-on-a-mac — dmckee --- ex-moderator kitten, Jul 05 '11 at 01:42
How to forward the mail: https://unix.stackexchange.com/questions/26666/can-i-change-roots-email-address-or-forward-it-to-an-external-address — Melebius, Dec 13 '16 at 14:24
In case anyone is looking, here is powerhshell one-liner to splits that into single files readable by outlook: `$i=0;(gc .\mail\root -raw) -split '[^, ]From '|%{$i++;sc mail$i.eml -value ("From " + $_)}` — JDuarteDJ, Apr 17 '18 at 15:23

score 448 · Accepted Answer · edited Aug 15 '17 at 06:15

448

Where is this mail?

It's likely to be in the spool file: /var/mail/$USER or /var/spool/mail/$USER are the most common locations on Linux and BSD.

(Other locations are possible – check if $MAIL is set – but by default, the system only informs you about /var(/spool)/mail.)

Usually the spool file is in a very simple mbox format, so you can open it in a text editor or pager.

For a slightly more convenient way, most distributions come with a program called mail (or Mail, mailx). You can try mutt or alpine; you can even configure it to be sent to an outside mailbox. (See "is this real mail?" below.)

What does it contain, and who/what sent it?

Most often the messages contain output of cron jobs, or a system security report by logwatch, or similar junk. Read it and find out.

How important is it?

Depends greatly on the contents of each message.

You should at least scan the subject headers – often people ignore the mail for months never realizing that their daily cron jobs fail.

Is this even actual "mail" in the same sense as email? Or is it just my system telling me something?

Yes to both – it's generated by your system telling you something, but it's also actual email and can be handled as such.

You can (and should) configure your mail software – the "MTA" aka /usr/sbin/sendmail – to forward the messages to your personal mail address. The exact instructions vary depending on which MTA (if any) you have installed, whether this is a personal computer or a server, whether you have your own domain or use a @gmail.com, and so on.

Note that /usr/sbin/sendmail nowadays is a shared API and doesn't necessarily mean the original Sendmail MTA. In fact, you shouldn't use Sendmail, but something more modern like OpenSMTPD, Postfix, or Exim4. All of them provide the same /usr/sbin/sendmail tool, but they're easier to configure, more secure, and just as powerful.

edited Aug 15 '17 at 06:15

Toastrackenigma

157
1
8

answered Jul 04 '11 at 16:30

u1686_grawity

426,297
64
894
966

3

Good answer. Had you added links with information on how to configure OpenSMTPD, Postfix or Exim4 to forward mail to your normal email address it would have been even better. – imolit Jun 04 '15 at 15:32
1

Here's a related question that shows how to setup **mutt**: http://askubuntu.com/a/499335/75735 – KalenGi Nov 08 '16 at 10:31
1

Great answer. But how do I use `mail` to read email? The [manpage](http://manpages.ubuntu.com/manpages/xenial/en/man1/mail.mailutils.1.html) doesn't say. – jpaugh Sep 19 '17 at 21:39
2

I viewed my mail with cat /var/mail/$USER command and removed it with rm -rf /var/mail/$USER command. – Sinan Eldem Nov 26 '17 at 09:04
@grawity should I delete the files in `/var/mail/` when I read them or just clear the text inside them? thank you! – yaylitzis Feb 06 '18 at 13:27
Is this the `sendmail` which was written by ESR? – Adam Arold Nov 21 '18 at 16:59
@AdamArold: No on both counts. "The original Sendmail" wasn't written by ESR as far as I know. Nowadays, the `/usr/sbin/sendmail` path doesn't refer to any specific software, but instead is a standard filename provided by a good dozen different implementations from different authors. – u1686_grawity Nov 21 '18 at 22:22
mail is marked as read by moving it from `/var/(spool/)mail/$USER` to `(/home)/$USER/mbox`. The `mail` program does this for you. – HyperActive May 05 '21 at 16:28
It was indeed `cron` telling me something useless. Is there a way to turn off sending mails by warnings from cronjobs? – Andyc Apr 05 '23 at 14:47
1

@Andyc: Make the cronjobs not _produce_ output. Use the appropriate "--quiet" or "silent" option of the program being run, or fix the job to not produce error messages by adding error checks where appropriate, or redirect the whole job's output to /dev/null like in shell (cronjobs use shell syntax). – u1686_grawity Apr 05 '23 at 15:30

score 271 · Answer 2 · edited Nov 29 '11 at 02:54

271

The easiest way for me was to run the following in a terminal:

cat /var/spool/mail/root

edited Nov 29 '11 at 02:54

Gaff

18,569
15
57
68

answered Nov 25 '11 at 11:46

Maclovin

2,866
1
14
5

5

Best practical answer so far that actually adds to the knowledge. Now I can read the mail. I wonder why it's the bottom most answer. – CDR Nov 29 '12 at 16:44
53

I realize this is a pretty old question/answer, but [this XKCD](http://xkcd.com/838/) is relevant to the discussion. (hint: hover text) – Blackhawk May 07 '14 at 21:05
25

Or just `less $MAIL` if you want to navigate. – Walf Jun 14 '16 at 02:13
21

Or `less +G $MAIL` to start at the end. – Charlie Gorichanaz Jul 18 '17 at 01:40
7

@Blackhawk And now even more [this XKCD](https://xkcd.com/1728/). – dessert Oct 21 '17 at 08:55
If you are on a user account, this worked for me: ```sudo cat $MAIL``` – Carter Nov 28 '20 at 17:31

score 98 · Answer 3 · edited Aug 31 '14 at 02:43

98

For anyone wondering how to read these messages one by one, you can just use 'mail'

$ mail

Then type a message number from the list which you want to read.

To goto the next message you can type 'next', another useful command is 'delete'..

To see more about how the mail program works, see the output of man mail.

edited Aug 31 '14 at 02:43

0xDAFACADE

766
3
17

answered Aug 30 '14 at 19:47

Dominic Williams

1,081
7
3

6

// , This doesn't actually work, on CEntOS 6. In that case, one must use `$ mailx`. – Nathan Basanese Jan 16 '16 at 00:06
12

On Ubuntu 16.04, I need to first install `mailutils` by running `apt install mailutils` – Edwin Yip Jul 17 '16 at 04:01
On Amazon EC2 instances, you can install it using `sudo yum install mail` – JonDoe297 Dec 20 '17 at 21:45
1

Works for me on macOS – juanmirocks Feb 07 '18 at 20:08
mail or mailx didn't work as advertised. this answer isn't very good, use mutt. – Alex Barker Oct 29 '19 at 16:01
Works for me, thanks – DS R Jan 21 '22 at 08:03

score 45 · Answer 4 · answered Jul 04 '11 at 16:31

Just to offer some clarification, it's been the tradition for a long time for UNIX boxes to run a "locally configured" mailer daemon that doesn't route messages through the Internet, but only copies messages to other users spool directories (as @John T mentioned). It is real SMTP-compliant email, it's just not routed over the Internet because it doesn't need to be.

So, if you fire up an email client (like alpine or mutt) you can send mail to other users on the system by addressing to user@hostname, or in many cases, just specifying the user. You also likely have a command line utility called mailx that can be used to send a quick email using your shell.

Now, if you want to send messages to users on systems other than the one you are logged in to, that's where the real fun begins. You'll need to configure your mailer daemon to recognize and hand off external email to a transfer agent, configure the transfer agent, and do a whole bunch of stuff I don't yet understand myself.

James T Snell · Answer 5 · 2018-08-23T20:17:50.553

28

Where is this mail?

Very likely stored on your machine, in the mailbox folder for your root user (where THAT is depends on what kind of mail server you have installed). You can probably access it quite quickly through alpine.

What does it contain?

Probably just some system report type stuff. "So and so tried to login 10 times with an incorrect password".. "I wish someone would run updates on me", "driver such-and-such is failing constantly", "The NSA bot has boosted performance by 1%".. etc..

Who/What sent it?

Services on your server, most likely.

How important is it?

Depends on how important your server is.

edited Aug 23 '18 at 20:17

answered Jul 04 '11 at 15:29

James T Snell

5,892
1
22
33

I think John's suggestion that it's stored in /var/spool/mail/root is based on a (good) assumption that you're running sendmail. I think other mail servers use different locations to store mail. – James T Snell Jul 04 '11 at 15:30
Is there a way for users to use the mail subsystem? – n0pe Jul 04 '11 at 15:31
White Phoenix: I'll take look when my mail is when I get the message again :) Is there a way for me to trigger it or is that too localized of a question? – n0pe Jul 04 '11 at 15:32
If you want to explore running your own mail server (that people use in a typical email sense), it'd first help to know what distro you're running? Without that info, all I'll say, is that I suggest you read up on sendmail (as you're probably running sendmail already).. – James T Snell Jul 04 '11 at 15:32
Most of them are running AIX but I'd like to explore this on my workstation at home running OpenSuSe – n0pe Jul 04 '11 at 15:37
Here's a sendmail tutorial: http://www.feep.net/sendmail/tutorial/ – James T Snell Jul 04 '11 at 15:40

Volker Siegel · Answer 6 · 2017-01-26T12:01:28.480

16

less +G /var/spool/mail/root

shows the latest mails, at the end if the file.

Directly showing the mail file is a good idea, but using cat can easily go wrong. You do not want all mails scroll by, if there are many messages, or very long messages in the file. I just saw one with 150MB, two million lines.

If you are not root:

sudo less +G /var/spool/mail/root

The +G option is used to show the newest message first; It is not at the top of the file, but on the end.

It is an option of less, making it show the last page of the file after starting. That show the last message (newest), if it fits to one page, or the end of that otherwise.

The file name may be /var/spool/mail/mail instead of /var/spool/mail/root

edited Jan 26 '17 at 12:01

answered Sep 03 '14 at 00:16

Volker Siegel

1,504
11
21

// , Excellent breakdown. This answer would be especially useful for those folks who don't easily know what to do with the file. – Nathan Basanese Jan 16 '16 at 00:20
4

In case anyone else is wondering, `+G` "causes less to initially display each file starting at the end rather than the beginning." (https://linux.die.net/man/1/less) – Sam Nov 24 '16 at 14:03

score 14 · Answer 7 · answered Jul 04 '11 at 15:28

14

This mail is typically located in /var/spool/mail/root when the (usual) default sendmail daemon is configured. It contains a RAW e-mail message that can be read by the mail utility. Who sent it can be found by running the mail utility and paging through the messages or reading the RAW headers.

The importance of the message usually depends on the previous factor, who sent it :)

Many system utilities will use the mail subsystem as a means of reporting and logging. Log watcher utilities and other services may send an e-mail to the local root user as a reminder about a specific event, such as low disk space or hardware errors. The mailer daemon will also alert you if it failed to send an e-mail outbound.

answered Jul 04 '11 at 15:28

John T

163,373
27
341
348

Is there a way to see how my mail subsystem is set up? – n0pe Jul 04 '11 at 15:29
@Max the `sendmail.mc` file controls configuration of the sendmail daemon on most default installs. It is typically located under `/etc/mail`. – John T Jul 04 '11 at 15:34
@Max I would strongly recommend reading through a tutorial such as http://www.linuxhomenetworking.com/wiki/index.php/Quick_HOWTO_:_Ch21_:_Configuring_Linux_Mail_Servers#The_.2Fetc.2Fmail.2Fsendmail.mc_File to help you configure the mailer daemon as desired. – John T Jul 04 '11 at 15:39
On ubuntu 16.4., I have `/etc/mail.rc` which is not related to `sendmail` – Timo Dec 24 '17 at 10:18

What is the "You have new mail" message in Linux/UNIX?

7 Answers7

Where is this mail?

What does it contain, and who/what sent it?

How important is it?

Is this even actual "mail" in the same sense as email? Or is it just my system telling me something?

Linked