On Tue, Oct 16, 2012 at 04:24:37PM +0200, Krzysztof Warzecha wrote: > 2012/10/16 gt <static.vortex@xxxxxxx>: > > Any idea what's causing it to show up? > > Well, you could always try brute force method. Login and run this as root: > > strace -vft -p $TARGET_GETTY_PID -o /tmp/strace-getty > > Now login in straced terminal, logout and grep for "New mail" in > /tmp/strace-getty. You will get (among other things) pid of process > which wrote "new mail" on screen. You can easily find (with grep) > parent process. I believe you know what to do from here ;). Ingenious method. Though I read sebastien's reply earlier and hence had found the culprit, i nevertheless tried yours too. First line of strace-getty showed pam_mail.so. Thanks.
