when are email alerts sent ?

[aloclarit]

Guys

I have been searching forever to find out what exactly causes cfexecd 
to send email alerts and how to tune it.
It doesn't seem very consistent at all.

I seem to only get one single alert and that is when i do an up2date on 
a package like util-linux f.e. which upgrades /bin/mount.
I have this in cfagent.conf :

files:
 /etc/passwd mode=644
 owner=root
 group=root
 action=fixall
 /etc/shadow mode=600
 owner=root
 group=root
 action=fixall
 /etc/group mode=644
 owner=root
 group=root
 action=fixall
 /bin/mount mode=4755
 owner=root
 group=root
 action=fixall
 checksum=md5
 /usr/bin/sudo owner=root
 group=root
 mode=4111
 checksum=md5
 action=fixall

As aI said upgrading the binary causes an email alert to be sent about 
the checksum having changed. However, if I mess with permissions and 
wait cfexecd will simply fix them but no alerts at all.
I was under the impression that every action that is carried out gets 
emailed to sysadm. What is the difference between a checksum change and 
a permission change ?

Also, has anyone seen the totally messed up FROM address those emails 
come from ? My cfengine box' hostname is cfengine and a look into the 
maillog show that the mail comes from :

cfengine@sysadmin@domain.com...in other words it seems to craft the 
FROM field by doing this: hostname@sysadm.

If I add the EmailFrom directive it only changes the from field I see 
in the actual email. The maillog still shows the wrong source address.

help ?