Oh, also run tcpdump to look at port 25 traffic to see if ossec-maild is trying to send email.
On Thu, May 3, 2012 at 9:07 AM, C. L. Martinez <[email protected]> wrote: > On Thu, May 3, 2012 at 2:57 PM, dan (ddp) <[email protected]> wrote: >> You're currently getting no emails at all? > Correct. > >> Are alerts actually being triggered? > Yes, for example: > > ** Alert 1336031183.72054663: mail - cpfirewall,cpfirewall_virtualdefrag, > 2012 May 03 09:46:23 (plzfsgsip01.adsi.intranet.local) > 10.196.0.90->/data/logs/chkp.log > Rule: 100106 (level 7) -> 'CheckPoint Firewall-1 alert by Virtual > defragmentation error.' > Src IP: 10.230.1.4 > Dst IP: 10.196.0.68 > May 3 09:46:22 10.196.0.36 checkpoint_logs: 3May2012 9:39:44 drop > 10.196.0.1 >Lan2 src: 10.230.1.4; dst: 10.196.0.68; proto: udp; > message: Virtual defragmentation error: Timeout; ip_id: 7132; ip_len: > 1432; ip_offset: 40; fragments_dropped: 2; during_sec: 60; product: > VPN-1 & FireWall-1; > >> Is ossec-maild running? > Yes, it is running. > >> Anything related to this in the ossec.log? > > No, nothing. > >> Try running the ossec processes in debug mode. > > ossec-maild?? or another?? >> >> On Thu, May 3, 2012 at 8:43 AM, C. L. Martinez <[email protected]> wrote: >>> Hi all, >>> >>> For what reason an ossec server can not send an email when an alert >>> is triggered?? After 15 days working ok, my ossec server doesn't sent >>> alerts after several minutes or hours when an alert is triggered. I >>> have configured "<do_not_delay />" and >>> <email_maxperhour>1000</email_maxperhour> in ossec.conf, but it >>> doesn't works. >>> >>> Any ideas??
