6,594 emails from my servers: What 20 years of robot mail tell
Summary
While building my mail archive, I found a folder with 6,594 emails that servers I was responsible for sent me between 2004 and 2025. Logwatch reports, cron output and warnings show how my server operations changed over twenty years. This post shows what this robot mail reveals, when it became a burden and how I would approach monitoring by email today.
A folder full of robot mail
My mail archive contains a folder that no human ever wrote to. It holds 6,594 emails from 2004 to 2025, all sent by servers I was responsible for: around 2,100 daily Logwatch reports, more than 4,200 outputs of cron jobs, 90 reports from the integrity checker AIDE and 169 traffic warnings from my hosting provider.
For this post I did not read the folder mail by mail, but counted it automatically: which reports arrived in which year and which services appear in them. That is enough to trace twenty years of server operations.
Twenty years of technology in fast motion
The early reports from 2004 onwards describe a typical server of the time: Apache, an FTP server, Sendmail and Courier for mail, ClamAV against viruses. In 2006 an iptables firewall appears, from 2007 Exim takes over mail, and disk space reports show up. In 2008 OpenVPN appears, and a cron job redials the DSL connection; these dial-up emails can be seen until 2015.
From 2013 the reports switch to Postfix and Dovecot. In 2015 SpamAssassin sends 188 emails about its rule updates. The reports from 2025 then mention Syslog-ng, Amavis, sudo logs and hourly backups with rsnapshot. The folder is an unplanned diary of my toolbox.
What you can take away: Automatic reports are documentation too. If you keep them, you can trace years later when which service came and went, without any maintained operations manual.
When the mail turns into a flood
The volumes vary a lot. In 2009, 1,471 emails arrived, including 332 from the security checker Tiger and 148 from vnstat. In 2018 there were even 1,693 emails, 1,224 of them from anacron runs alone, so more than three a day. In 2025 there were again more than 1,000 emails, and the Logwatch reports came from twelve servers.
To be honest, I never read most of them. With several emails a day, each one becomes noise. And then you do not notice when one is missing, or when one of them finally contains something important.
What you can take away: A warning that arrives every day is no longer a warning. Let jobs send email only when something goes wrong, for example with the tool chronic from moreutils, which passes on a command’s output only if it fails.
The gap in between
Between 2010 and 2014 the folder contains hardly any emails, some years only a handful. The servers were not silent during that time. I simply deleted most of their emails back then.
Today that annoys me a little. Exactly these years are now missing from my toolbox diary, and anyone looking only at the folder might think nothing happened.
What you can take away: A gap in the archive proves nothing, neither that everything worked nor that something was missing. If you delete reports, you also delete history. Better archive them in a separate folder than throw them away.
What I would do differently today
For twenty years, Logwatch and cron emails gave me a view of my servers that cost nothing. For an overview they are still good today. For alerts they are only of limited use.
Today I would separate them: daily reports go into a folder of their own that I read consciously now and then, and real alerts only on errors, through a channel that gets noticed. And because monitoring by email cannot report that it has failed itself, important systems would also send a regular heartbeat to a monitoring service that raises the alarm when it stops.
What you can take away: Separate reports from alerts. Reports may be quiet, alerts must be rare and loud.
Numbers at a glance
- The folder contains 6,594 automatic emails from the years 2004 to 2025.
- Among them are around 2,100 Logwatch reports from a total of 28 different server names.
- In 2018, 1,224 emails came from anacron runs alone.
- chronic from moreutils only prints a command’s output if the command fails.
References
Remarks
- The numbers come from an automatic count of subject lines and section headings; other report contents, addresses and host names were not analysed.
Links to the original source and the Web Archive open in a new tab.