How to Read, Empty and Stop Root Mail on a Linux Server

Updated: 28 September 2026 · Applies to: AlmaLinux and Rocky Linux 9 and 10, RHEL 9 and 10, Ubuntu 24.04 and 26.04, Debian 13 (including cPanel servers)

Cron jobs, security tools and system services send their messages to the root user. On a server without anyone reading them, the root mailbox can grow to hundreds of megabytes. This guide shows how to read, empty and stop that mail. We tested the commands on AlmaLinux 10 and Debian 13.

Where the mailbox is

Root's mailbox is the file /var/spool/mail/root. The path /var/mail/root points to the same file on all these systems. Check its size:

ls -lh /var/spool/mail/root

1. Read before you delete

Look through the messages first: they may contain warnings about failed backups, full disks or security problems.

dnf install s-nail      # AlmaLinux, Rocky Linux, RHEL
apt install mailutils   # Ubuntu, Debian
mail

mail opens root's mailbox. Type a message number to read it, d 1-50 to delete a range, d * to delete all messages and q to quit and save the changes.

To list only the subjects: mail -H.

2. Empty the mailbox

To delete all messages at once, empty the file instead of removing it, so its owner and permissions stay the same:

truncate -s 0 /var/spool/mail/root

Or delete all messages with the mail program, which locks the mailbox while it works:

printf 'd *\nq\n' | mail -N

3. Stop the flood at the source

Emptying the mailbox helps only until the next messages arrive. Better:

• Forward root's mail to a real address so someone reads it. Add to /etc/aliases and rebuild the alias database:

  root: admin@example.com

  newaliases

  The server needs a working mail setup for this. On cPanel servers, root's mail is forwarded with the file /root/.forward (one address per line), and WHM's Basic WebHost Manager Setup holds the contact address for cPanel's own notices.
• Quiet noisy cron jobs. Cron mails any output of a job. Send the normal output of a job to /dev/null and keep the errors, for example:

  0 3 * * * /usr/local/bin/backup.sh > /dev/null

  Or set MAILTO="" at the top of the crontab to stop mail from all its jobs (do this only if the jobs log elsewhere).
• Check what sends the most: grep '^Subject:' /var/spool/mail/root | sort | uniq -c | sort -rn | head.

Official documentation: crontab(5) manual and Postfix aliases manual.