Chuck, Did you ever resolve this email notification issue? I'd like to add and entry on the wiki but want to make sure the issue was resolved first.
Cheers, -cnk- On Tue, Mar 18, 2008 at 11:17 AM, Chuck Braden <[EMAIL PROTECTED]> wrote: > > Well, our mail server admin says the DNS name from the ossec server is not > fully qualified. Can someone tell me how to change that? > > It is registered in our DNS server. > > Mar 11 20:45:04 sr-5-int postfix/smtpd[7146]: connect from > myfully.qualified.dnsname.here [myiphere] > Mar 11 20:45:04 sr-5-int postfix/smtpd[7146]: NOQUEUE: reject: RCPT from > myfully.qualified.dnsname.here[myiphere]: 504 <[EMAIL PROTECTED]>: Sender > address rejected: need fully-qualified address; from=<[EMAIL PROTECTED]> > to=<[EMAIL PROTECTED]> proto=SMTP helo=<notify.ossec.net> > Mar 11 20:45:04 sr-5-int postfix/smtpd[7146]: lost connection after RCPT > from myfully.qualified.dnsname.here [myiphere] > Mar 11 20:45:04 sr-5-int postfix/smtpd[7146]: disconnect from > myfully.qualified.dnsname.here [myiphere] > > The messages are being 504ed because the From address isn't [EMAIL PROTECTED] > > >>> Michael Starks <[EMAIL PROTECTED]> 3/12/2008 5:29 PM >>> > > > > Chuck Braden wrote: > > Well, im still seeing the same thing in the error log. > > > > 2008/03/11 11:29:11 os_sendmail(1705): RCPT TO not accepted by server > > 2008/03/11 11:29:11 ossec-maild(1223): Error Sending email to > 165.91.22.120 (smtp server) > > I believe you'll see this error if one or more of the recipients isn't > valid. If this is the case, OSSEC won't send the alert to any of the > recipients. > >
