dnf-automatic notification transition for security-only alerts on Rocky Linux 9

Answer

To confirm that the email emitter in dnf-automatic is working and to avoid silent failures when the local MTA is unavailable, follow these steps:

1. Verify the sendmail command: Ensure the mailto setting in /etc/dnf/automatic.conf points to an executable that behaves like sendmail -t (e.g., /usr/sbin/sendmail).
2. Test delivery locally: Run a manual test using the same command:

   echo -e "Subject: dnf-automatic test\n\nThis is a test message." | /usr/sbin/sendmail -t

   Then check the mail log for a successful entry:

   grep "status=sent" /var/log/maillog

   or view the queue with mailq; an empty queue after a short wait indicates the message was accepted and delivered locally.
3. Check dnf-automatic logs: After a timer run, look for email‑related messages:

   journalctl -u dnf-automatic.timer --since "10 minutes ago" | grep -i email

   A non‑zero exit from the sendmail command will appear as an error here.

Likely explanation

The email emitter relies on a local MTA to accept mail from the sendmail command. If the MTA is missing or misconfigured, the command may fail silently unless its exit status is logged by dnf-automatic or the system mail log.

Confirmed facts

• When upgrade_type = security and apply_updates = no, only security errata trigger the email emitter.
• A minimal local MTA (e.g., Postfix with relayhost = [] and mydestination = $myhostname, localhost.localdomain, localhost) will accept locally generated mail and store it in the system mail spool, making delivery observable via mailq or /var/log/maillog.
• If the sendmail command is not executable or returns a non‑zero status, dnf-automatic logs an error to the journal; otherwise, no error is visible.

Recommended method to prevent silent drops

1. Deploy a local‑only MTA: Install and configure Postfix (or exim) to listen only on localhost and accept mail for local delivery. This guarantees that the sendmail command succeeds and the message appears in the local mail spool.
2. Alternative: redirect output to a log or syslog: If running an MTA is undesirable, change the mailto setting to a wrapper script that logs the message, for example:

   # /usr/local/bin/dnf-automatic-mail-logger
   #!/bin/sh
   logger -t dnf-automatic "$(cat)"
   

   Make it executable and set mailto = /usr/local/bin/dnf-automatic-mail-logger in /etc/dnf/automatic.conf. This ensures notifications are always visible in the system journal.
3. Monitor: Set up a simple cron or systemd timer that checks mailq or the log file for pending messages and alerts if the queue grows unexpectedly.

Assumptions

The steps assume you have root access to modify /etc/dnf/automatic.conf and to install or configure a local MTA. If the system is intentionally kept without any MTA, the wrapper‑script approach is the only reliable way to avoid silent drops.