# Rkhunter daily email not being sent **URL:** \ **Category:** Documentation\ **Created:** [April 13, 2023, 12:39pm UTC](https://forums.rockylinux.org/t/rkhunter-daily-email-not-being-sent/9546 "2023-04-13T12:39:54Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![ddestroyer](https://avatars.discourse-cdn.com/v4/letter/d/74df32/32.png) [@ddestroyer](https://forums.rockylinux.org/u/ddestroyer)\ **Post date:** [April 13, 2023, 12:39pm UTC](https://forums.rockylinux.org/t/rkhunter-daily-email-not-being-sent/9546/1 "2023-04-13T12:39:54Z")
Following the Rocky Linux rkhunter setup doc, does not produce working rkhunter emails daily reports on Rocky Linux 9. Email reports do work for Rocky Linux 7 and 8. [https://docs.rockylinux.org/guides/web/apache\_hardened\_webserver/rkhunter/](https://docs.rockylinux.org/guides/web/apache_hardened_webserver/rkhunter/) /etc/rkhunter.conf MAIL-ON-WARNING=root postfix is working as other email reports are working like logwatch which also use root alias. I do not recognize any rkhunter log email sending errors. Wondering if anyone else has run into this as none of my Rocky 9 systems are sending rkhunter daily reports. Thank you, Dave ---
**Author:** ![sspencerwire](https://avatars.discourse-cdn.com/v4/letter/s/c2a13f/32.png) [@sspencerwire](https://forums.rockylinux.org/u/sspencerwire)\ **Post date:** [April 13, 2023, 1:26pm UTC](https://forums.rockylinux.org/t/rkhunter-daily-email-not-being-sent/9546/2 "2023-04-13T13:26:35Z")
Greetings Dave and Welcome! Have you removed the comment from the following line in the `rkhunter.conf` file as well: ```auto MAIL_CMD=mail -s "[rkhunter] Warnings found for ${HOST_NAME}" ``` Also, have you tried running `rkhunter --check` manually to see if any warnings are found that _would_ generate an email? You can take a look at our [document for rkhunter here](https://docs.rockylinux.org/guides/web/apache_hardened_webserver/rkhunter/) Admittedly, it needs to reference removing the comment on the `MAIL-CMD` line as well. Here is what I received on a fresh install of `rkhunter` on a container where I expected some warnings (and got them): ```auto tail -f /var/mail/root id EC2F9C0001227; Thu, 13 Apr 2023 08:19:28 -0500 (CDT) Date: Thu, 13 Apr 2023 08:19:28 -0500 To: root@rockylinux-test-9.localdomain Subject: [rkhunter] Warnings found for rockylinux-test-9 User-Agent: s-nail v14.9.22 Message-Id: <20230413131928.EC2F9C0001227@rockylinux-test-9.localdomain> From: root Please inspect this machine, because it may be infected. ``` ---
**Author:** ![ddestroyer](https://avatars.discourse-cdn.com/v4/letter/d/74df32/32.png) [@ddestroyer](https://forums.rockylinux.org/u/ddestroyer)\ **Post date:** [April 13, 2023, 1:54pm UTC](https://forums.rockylinux.org/t/rkhunter-daily-email-not-being-sent/9546/3 "2023-04-13T13:54:12Z")
Maybe I just never noticed this before. But I just did Rocky 9 updates on the systems this morning and I made a no root login SSH change that usually causes a rkhunter report to sent the email. Maybe a recent change to where rkhunter daily does not sent status unless it sees warnings? ``` if [$XITVAL != 0]; then /bin/cat $TMPFILE1 | /bin/mail -s "rkhunter Daily Run on $(hostname)" $MAILTO fi /bin/cat $TMPFILE1 >> $LOGFILE ``` * * * otherwise it worked. --------------------- Start Rootkit Hunter Update --------------------- [Rootkit Hunter version 1.4.6] Checking rkhunter data files… Checking file mirrors.dat [No update] Checking file programs\_bad.dat [No update] Checking file backdoorports.dat [No update] Checking file suspscan.dat [No update] Checking file i18n/cn [No update] Checking file i18n/de [No update] Checking file i18n/en [No update] Checking file i18n/tr [No update] Checking file i18n/tr.utf8 [No update] Checking file i18n/zh [No update] Checking file i18n/zh.utf8 [No update] Checking file i18n/ja [No update] ---------------------- Start Rootkit Hunter Scan ---------------------- Warning: The SSH and rkhunter configuration options should be the same: SSH configuration option ‘PermitRootLogin’: no Rkhunter configuration option ‘ALLOW\_SSH\_ROOT\_USER’: unset ----------------------- End Rootkit Hunter Scan ----------------------- Thank you! ---
**Author:** ![sspencerwire](https://avatars.discourse-cdn.com/v4/letter/s/c2a13f/32.png) [@sspencerwire](https://forums.rockylinux.org/u/sspencerwire)\ **Post date:** [April 13, 2023, 7:52pm UTC](https://forums.rockylinux.org/t/rkhunter-daily-email-not-being-sent/9546/4 "2023-04-13T19:52:20Z")
Exactly, @ddestroyer : `rkhunter` will run, but it isn’t going to send you anything unless it sees a warning. A manual run with `--check` will give you a preview of the tests and whether there are any warnings or not. I’m not remembering if the SSH settings will generate a warning (just a notice in the log as you’ve shown) when you run `--check`. If your checks return no warnings, then my guess is that `rkhunter` is working as expected. ---
**Author:** ![sspencerwire](https://avatars.discourse-cdn.com/v4/letter/s/c2a13f/32.png) [@sspencerwire](https://forums.rockylinux.org/u/sspencerwire)\ **Post date:** [April 13, 2023, 7:56pm UTC](https://forums.rockylinux.org/t/rkhunter-daily-email-not-being-sent/9546/5 "2023-04-13T19:56:19Z")
You can also script your own report to echo the contents of the rkhunter log regardless of warning status. ---
**Author:** ![ddestroyer](https://avatars.discourse-cdn.com/v4/letter/d/74df32/32.png) [@ddestroyer](https://forums.rockylinux.org/u/ddestroyer)\ **Post date:** [April 14, 2023, 12:24pm UTC](https://forums.rockylinux.org/t/rkhunter-daily-email-not-being-sent/9546/6 "2023-04-14T12:24:05Z")
Sounds good, thank you for the confirmation! ---
**Author:** ![brian](https://sea2.discourse-cdn.com/flex020/user_avatar/forums.rockylinux.org/brian/32/5777_2.png) [@brian](https://forums.rockylinux.org/u/brian)\ **Post date:** [August 25, 2023, 3:18am UTC](https://forums.rockylinux.org/t/rkhunter-daily-email-not-being-sent/9546/7 "2023-08-25T03:18:11Z")