Getting Blank RKhunter Scan Result Emails.

RKhunter checks a Linux or Unix server for known rootkits, changed system commands, suspicious startup files and unusual network settings. A blank email does not automatically mean the scan failed. When --report-warnings-only is used, a clean scan can legitimately produce no message body.

The other common causes are a different command path under cron, a missing mail program, a mail delivery failure or scan errors being written to standard error instead of the piped report.

Confirm whether RKhunter produced a report

Run the same command manually as root before changing the cron job:

rkhunter --check --skip-keypress --report-warnings-only

The --skip-keypress option prevents interactive prompts. The warning-only option deliberately hides successful checks. This behaviour is documented in the RKhunter manual.

Run a normal check when you need to see the full summary:

rkhunter --check --skip-keypress

Then inspect the log file. The usual location is:

tail -n 100 /var/log/rkhunter.log

If the full scan and log contain results but warning-only mode prints nothing, RKhunter is working and there were no warnings to email.

Check the command paths used by cron

Cron normally has a smaller PATH than an interactive shell. Find the real locations of RKhunter and your mail client:

command -v rkhunter
command -v mail

Package installations commonly place RKhunter at /usr/bin/rkhunter. Manual installations may use /usr/local/bin/rkhunter. Use the path returned by your server rather than assuming one location.

Test the mail pipeline separately:

printf 'RKhunter mail test\n' | /usr/bin/mail -s 'RKhunter mail test' admin@example.com

Check the mail log if the message does not arrive. Depending on the distribution and mail service, useful locations include /var/log/maillog and /var/log/mail.log.

Use a cron script that captures errors

Create /usr/local/sbin/rkhunter-report with the following content. Update the command paths and recipient for your server.

#!/bin/sh
PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
HOST_NAME=$(hostname -f 2>/dev/null || hostname)
REPORT=$(mktemp /tmp/rkhunter-report.XXXXXX)
trap 'rm -f "$REPORT"' EXIT

/usr/bin/rkhunter --check --skip-keypress --report-warnings-only >"$REPORT" 2>&1

if [ -s "$REPORT" ]; then
    /usr/bin/mail -s "RKhunter warnings on $HOST_NAME" admin@example.com <"$REPORT"
fi

Make the script executable and test it directly:

chmod 750 /usr/local/sbin/rkhunter-report
/usr/local/sbin/rkhunter-report

Add it to root's crontab only after the direct test succeeds:

15 3 * * * /usr/local/sbin/rkhunter-report

This version captures both normal output and errors. It sends a message only when the report contains something, which prevents empty warning emails after clean scans.

Check configuration and file baselines carefully

Validate the RKhunter configuration before scheduling it:

rkhunter --config-check

Do not use rkhunter --propupd merely to remove warnings. That command accepts the current file properties as the trusted baseline. Run it only after confirming that the system and changed files are legitimate.

RKhunter is one signal, not proof that a server is clean or compromised. Investigate warnings using package verification, authentication logs, process activity and network connections. For a wider review, the server security service covers hardening and hands-on incident investigation for infrastructure you already control.

Verify the scheduled scan

After the next scheduled run, confirm that cron executed the script and that the RKhunter log timestamp changed. You can also temporarily replace warning-only mode with the full summary during testing, then restore it after mail delivery is confirmed.

A clean warning-only scan should result in no email. A warning or command error should produce a message with useful content rather than an empty body.