Bug 159254 - Arpwatch emails are empty.
Arpwatch emails are empty.
Status: CLOSED WORKSFORME
Product: Red Hat Enterprise Linux 4
Classification: Red Hat
Component: tcpdump (Show other bugs)
4.0
All Linux
medium Severity medium
: ---
: ---
Assigned To: Martin Stransky
:
Depends On:
Blocks:
  Show dependency treegraph
 
Reported: 2005-05-31 17:30 EDT by Ali-Reza Anghaie
Modified: 2007-11-30 17:07 EST (History)
0 users

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2005-07-21 07:17:49 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)
One more time. (1.66 KB, text/plain)
2005-06-22 06:30 EDT, Ali-Reza Anghaie
no flags Details

  None (edit)
Description Ali-Reza Anghaie 2005-05-31 17:30:17 EDT
Description of problem:

(I don't see arpwatch listed as a component, assigning to distribution for now.)

Arpwatch emails always end up empty although the syslog entry has the MAC address.

Version-Release number of selected component (if applicable):

arpwatch-2.1a13-9.RHEL4

How reproducible:

Always.

Steps to Reproduce:
1. Just enable arpwatch and wait.
2.
3.
  
Actual results:

Emails are empty.

Expected results:

Expect MAC addresses to be emailed.

Additional info:

I also putzed with the OPTIONS line of /etc/sysconfig/arpwatch to no avail. I
don't see any errors in the syslog regarding the email trying to be sent. It
just ends up empty.
Comment 1 Ali-Reza Anghaie 2005-06-21 07:24:23 EDT
For the record a ~change~ in MAC to IP actually triggers an email with
the proper data. It's just a new record that doesn't, I didn't notice
the change emails until recently. Cheers, -Ali
Comment 2 Martin Stransky 2005-06-21 10:38:14 EDT
Hm, have you made any changes? Sending mail works for me on fresh
installed RHEL4. Have you properly installed all mail programs? like
sendmail, procmail...
Comment 3 Ali-Reza Anghaie 2005-06-21 18:39:51 EDT
Yes, it works fine. Note that only the ~new~ MAC discoveries send
emtype emails but log fine. The changes, as I note in my last update,
work fine in the first place. This is a RHEL 4 up2date-d. Sendmail
works just fine, outbound emails and the local queue work fine.

arpwatch-2.1a13-10.RHEL4 currently and that exhibits the same problem.
Hrmm. -Ali
Comment 4 Martin Stransky 2005-06-22 03:47:25 EDT
Can you past here a part of logfile, when arpwatch writes log and does
not send correct email?
Comment 5 Ali-Reza Anghaie 2005-06-22 06:30:47 EDT
Created attachment 115802 [details]
One more time.
Comment 6 Ali-Reza Anghaie 2005-06-22 06:31:46 EDT
I added the attachment because Bugzilla generated an error (two times
it failed, first time with no message). The attachement has my update
plus the Bugzilla error. Cheers, -Ali
Comment 7 Martin Stransky 2005-06-27 06:30:09 EDT
Can you attach a mail which is generated by arpwatch? (With all headers)
Comment 8 Martin Stransky 2005-06-27 08:30:34 EDT
http://people.redhat.com/stransky/tcpdump/tcpdump-3.8.2-11.mail.src.rpm

Here is a testing version of arpwatch which doesn't delete
/tmp/arpwatch.XXXXX files. Those contains mail messages which are sent
by sendmail. You can send it manually by "sendmail -odi root
/tmp/arpwatch.XXXXX" and investigate if there are any errors...

Comment 9 Martin Stransky 2005-07-01 04:15:51 EDT
Any news?
Comment 10 Ali-Reza Anghaie 2005-07-01 04:55:28 EDT
I can work on this during the weekend, haven't had time. Sorry. I'll
pull the package and rpmbuild --rebuild it, etc. -Ali
Comment 11 Ali-Reza Anghaie 2005-07-01 05:35:02 EDT
Bloody Bugzilla keeps erroring out on the commit.

I rebuilt the SRPM but see no overlap between the tcpdump and
arpwatch. Are you sure this is what you want me to do or was posting
the SRPM for tcpdump a mistake?
Comment 12 Martin Stransky 2005-07-01 05:48:51 EDT
After rebuild, install only arpwatch-2.1a13-11.mail.i386.rpm package
which is included in tcpdump source rpm...
Comment 13 Ali-Reza Anghaie 2005-07-01 06:14:15 EDT
Yeah, I noticed that a bit too late. *sigh*

I did that but nada, the sendmail -odi root < arpwatch.foo works fine
without error and the email comes blank. Did you see my attachment
above? That strangeness in the header still appears though. It still
looks like the first line for 'hostname' is getting cutof as 'me:'...

I tried turning off all anti-spam features, etc. and that didn't help.
I thought perhaps mime defang was doing something.

No joy. :-/  I've gotta run, sorry for being brain dead this morning.
I'll check again later.
Comment 14 Martin Stransky 2005-07-21 07:17:49 EDT
Reopen it please, if you find anything new.

Note You need to log in before you can comment on or make changes to this bug.