Not so long ago I have found that exim is sending mail4root emails and logs them into /var/mail/mail. Example from exim log:2016-07-19 09:39:02 1bPOgI-000370-1Q <= root@example.net U=root P=local S=784592016-07-19 09:39:02 1bPOgI-000370-1Q => /var/mail/mail <root@example.net> R=mail4root T=address_file2016-07-19 09:39:02 1bPOgI-000370-1Q Completed2016-07-19 09:40:18 Start queue run: pid=121172016-07-19 09:40:18 End queue run: pid=121172016-07-19 10:09:02 1bPP9K-00042T-LK <= root@example.net U=root P=local S=784592016-07-19 10:09:02 1bPP9K-00042T-LK => /var/mail/mail <root@example.net> R=mail4root T=address_file2016-07-19 10:09:02 1bPP9K-00042T-LK Completed2016-07-19 10:10:18 Start queue run: pid=156782016-07-19 10:10:18 End queue run: pid=15678Can someone explain what causes it?
Exim4 sends strange emails on root
debian;email;exim
As a security measure Exim will not deliver email to root.   The mail4root router is a last ditch handler to deliver mail for root to the mailbox for mail.Normally, an alias for root would be configured in /etc/aliases to deliver to the system administrator's personal mailbox.  There are a number of aliases that redirect to root as they should be handled by the system administrator (root).  They also get redirected if the alias exists.