“You have new mail” message in Linux

Sometimes, when you log in to the Linux server using the command-line interface (SSH – Secure Shell Protocol), you may have read this message “You have new mail” just after a successful login screen.

Where is this mail? What does it contain? Who or what sent it?

In this article, I’ll try my best to answer all those questions that a newbie could ask.

Where is this mail?

It’s likely to be in the spool file, if this is the first time you got this message then remember that these mails are located in the /var/spool/mail/$USER or /var/mail/$USER, both are the most common locations on Linux and BSD.

$USER will be either root or any other system user associated with the server. In some Linux distributions, it could be a different directory, so check where the system’s spool file goes. Or you can check with the mail application (or mailx). You can even configure it to be sent to an outside mailbox, which requires further installation and settings.

How to read this mail?

Simply just concatenate to the file:

cat /var/spool/mail/root

Now, you can now read all the mails here.

What does it contain? Who or what sent it?

Most often the messages contain the output of cron jobs, a system security report by log monitor, or similar junk. All you have to do is to read it and find out what is that mail about. God knows what would be in the mail.

How important is it?

Depends greatly on the contents of each message. You should at least scan the subject headers – often people ignore the mail for months never realizing that their daily cron jobs fail. Rest you could receive messages from services you install in the Linux box or server.

Usually, those messages are just notifications and updates.