What do the "daily run output" emails mean?

[pasqualy]

Hi all,

I finished setting up a FreeNAS 9.2.1-RELEASE-x64 server yesterday and last night got my first daily email from it. I have no idea how to interpret the content of this email or what warning signs of potential problems look like. This is what was in the email:

Backing up mail aliases:
freenas.local aliases diffs:
--- /var/backups/aliases.bak 2014-08-05 16:14:03.000000000 -0400
+++ /etc/mail/aliases 2014-08-06 15:31:16.000000000 -0400
@@ -77,4 +77,5 @@

# bit-bucket: /dev/null
# dev-null: bit-bucket
+root: rootuser@mydomain.xx
username1: user1@mydomain.xx

-- End of daily output --

I'm fairly new to FreeNAS and FreeBSD so I'm sorry if this has an obvious answer but I couldn't find one through Google or searching the forums.

Thanks in advance!

 

[pasqualy]

I've done some more research and tinkering since posting this and my best guess is that this email is a notification about a system file being edited. Specifically, it's saying that /etc/mail/aliases was edited at 2014-08-06 15:31:16.000000000 -0400. The following line, "@@ -77,4 +77,5 @@" is saying that 4 lines were removed starting from line 77, then 5 were added starting from line 77. The last block of text is showing the edited section (in this case lines 77 through 81).

I'm still unsure what the "+++" and "---" before the file names mean though. Can anyone tell me?

 

[dlavigne]

They indicate the from and to files being compared in a unified diff: http://www.chemie.fu-berlin.de/chemnet/use/info/diff/diff_3.html#SEC21.

 

[pasqualy]

Thank you for your help! Just to be sure I'm understanding all of this correctly:

FreeNAS creates a backup of user accounts/emails every night by comparing the /var/backups/aliases.bak to /etc/mail/aliases. In the example in the OP, this comparison found that the line "root: rootuser@mydomain.xx" had been added to /etc/mail/aliases but was not in /var/backups/aliases.bak.

Next question: In my attempts to figure this out, I created a test user and looked at /etc/mail/aliases to see what changed. I then deleted the user about 20 minutes later. That night, there was no email about any changes having been made. Is this because the comparison is made at a specific time (I'm guessing midnight) and so any changes made and undid before the check occurs will not be noticed? If so, is there any way to have the server send an email when a system file (i.e. not a file that is being stored by users) is changed/added/removed?

 

[dlavigne]

Next question: In my attempts to figure this out, I created a test user and looked at /etc/mail/aliases to see what changed. I then deleted the user about 20 minutes later. That night, there was no email about any changes having been made. Is this because the comparison is made at a specific time (I'm guessing midnight) and so any changes made and undid before the check occurs will not be noticed? If so, is there any way to have the server send an email when a system file (i.e. not a file that is being stored by users) is changed/added/removed?

The email is the result of a periodic script named the daily security output. This script runs every night at 3am by default on FreeBSD-based systems. At this time, FreeNAS does not let you change the config file that controls the periodic scripts--that feature request is at https://bugs.freenas.org/issues/3548.