I have do it and no traffic appears when an alert is triggered, according to alerts.log ...
On Thu, May 3, 2012 at 3:11 PM, dan (ddp) <[email protected]> wrote: > Oh, also run tcpdump to look at port 25 traffic to see if ossec-maild > is trying to send email. > > On Thu, May 3, 2012 at 9:07 AM, C. L. Martinez <[email protected]> wrote: >> On Thu, May 3, 2012 at 2:57 PM, dan (ddp) <[email protected]> wrote: >>> You're currently getting no emails at all? >> Correct. >> >>> Are alerts actually being triggered? >> Yes, for example: >> >> ** Alert 1336031183.72054663: mail - cpfirewall,cpfirewall_virtualdefrag, >> 2012 May 03 09:46:23 (plzfsgsip01.adsi.intranet.local) >> 10.196.0.90->/data/logs/chkp.log >> Rule: 100106 (level 7) -> 'CheckPoint Firewall-1 alert by Virtual >> defragmentation error.' >> Src IP: 10.230.1.4 >> Dst IP: 10.196.0.68 >> May 3 09:46:22 10.196.0.36 checkpoint_logs: 3May2012 9:39:44 drop >> 10.196.0.1 >Lan2 src: 10.230.1.4; dst: 10.196.0.68; proto: udp; >> message: Virtual defragmentation error: Timeout; ip_id: 7132; ip_len: >> 1432; ip_offset: 40; fragments_dropped: 2; during_sec: 60; product: >> VPN-1 & FireWall-1; >> >>> Is ossec-maild running? >> Yes, it is running. >> >>> Anything related to this in the ossec.log? >> >> No, nothing. >> >>> Try running the ossec processes in debug mode. >> >> ossec-maild?? or another?? >>> >>> On Thu, May 3, 2012 at 8:43 AM, C. L. Martinez <[email protected]> wrote: >>>> Hi all, >>>> >>>> For what reason an ossec server can not send an email when an alert >>>> is triggered?? After 15 days working ok, my ossec server doesn't sent >>>> alerts after several minutes or hours when an alert is triggered. I >>>> have configured "<do_not_delay />" and >>>> <email_maxperhour>1000</email_maxperhour> in ossec.conf, but it >>>> doesn't works. >>>> >>>> Any ideas??
