service/email.md

@@ -431,8 +431,40 @@ can be used as well](https://doc.dovecot.org/configuration_manual/authentication
 
 ## Pager playbook
 
-No pager playbook has been built yet. See the [tests section](#tests) below
-for ideas on how to debug the submission server.
+A limited number of pager playbooks have written, much more needs to
+be done. See the [tests section](#tests) below for ideas on how to debug
+the submission server.
+
+### Files are present in /var/mail
+
+The `FilesInVarMail` alert looks like this:
+
+    Files are present in /var/mail on eugeni.torproject.org
+
+This happens when Postfix doesn't find a proper alias to deliver mail
+for a user and ends up writing to a mailbox in /var/mail. Normally,
+this shouldn't happen: emails should be forwarded to a service admin
+or TPA, or be routed to Dovecot, which then writes mailboxes in
+`~/Maildir`, not `/var/mail`.
+
+This is not urgent, it's just a misconfiguration.
+
+The solution is to add a `postfix::alias` entry for that user,
+pointing either at TPA or the responsible service admin. Ideally,
+check the file size and the number of messages in it with:
+
+    du -sch /var/mail/*
+    grep -c ^From /var/mail/*
+
+It's possible those are errors from a daemon or cron job that could
+easily be fixed as well, without even having to redirect mail to an
+alias. Another possibility is to convert a cron job to a
+`systemd::timer` in Puppet.
+
+Those metrics are themselves generated by a systemd timer. You can
+reproduce the metric by running the command:
+
+    /usr/local/bin/directory-size-inodes /var/mail
 
 ## Disaster recovery