Hello, Thanks for testing this. So let’s go through this step by step…
First of all, is the companion daemon running? It is a process called suricata-reporter. If so, can you check if the configuration file has emails enabled? It is in /var/ipfire/suricata/reporter.conf. And finally, can you run “mailq” to see if the emails have been sent and maybe have bounced? -Michael > On 29 Sep 2025, at 13:58, Adolf Belka <[email protected]> wrote: > > Forgot to mention, I pressed the test button on the Mail Service WUI page and > immediately received the test mail message. > > I use a mail server I have running on my local network. > > Regards, > > Adolf. > > > On 29/09/2025 14:52, Adolf Belka wrote: >> Hi All, >> I just ran the update for CU198 Testing on my vm systems. >> The update itself went fine without any error messages or hiccups. >> I then went to test the IPS emailing of alerts. >> I used the same sender and recipient email addresses as I have specified on >> the Mail Service WUI page. >> I set the alert severity to All, Including Informational Alerts. >> I then followed the suricata testing process as defined in >> https://docs.suricata.io/en/suricata-8.0.1/quickstart.html#alerting >> and I ended up with alerts in the IPS-Logs but no email message received. >> I checked the System logs for the mail system and there was no message >> trying to be sent. I ran the test 7 times, so ended up with 7 messages in >> the IPS-Logs. >> I then checked the IPS system Logs and there was no mention of detecting the >> alerts and trying to send an email. >> I ran the command tail -f /var/log/messages so I could see any additional >> log entries when I triggered the IPS alerts but again nothing was shown when >> I triggered the alerts, although the messages did end up in the IPS Logs >> section. >> Regards, >> Adolf. > >
