And you're definitely not hitting the 1000 mail limit? What is your configuration exactly?
On Thu, May 3, 2012 at 9:14 AM, C. L. Martinez <[email protected]> wrote: > I have do it and no traffic appears when an alert is triggered, > according to alerts.log ... > > > On Thu, May 3, 2012 at 3:11 PM, dan (ddp) <[email protected]> wrote: >> Oh, also run tcpdump to look at port 25 traffic to see if ossec-maild >> is trying to send email. >> >> On Thu, May 3, 2012 at 9:07 AM, C. L. Martinez <[email protected]> wrote: >>> On Thu, May 3, 2012 at 2:57 PM, dan (ddp) <[email protected]> wrote: >>>> You're currently getting no emails at all? >>> Correct. >>> >>>> Are alerts actually being triggered? >>> Yes, for example: >>> >>> ** Alert 1336031183.72054663: mail - cpfirewall,cpfirewall_virtualdefrag, >>> 2012 May 03 09:46:23 (plzfsgsip01.adsi.intranet.local) >>> 10.196.0.90->/data/logs/chkp.log >>> Rule: 100106 (level 7) -> 'CheckPoint Firewall-1 alert by Virtual >>> defragmentation error.' >>> Src IP: 10.230.1.4 >>> Dst IP: 10.196.0.68 >>> May 3 09:46:22 10.196.0.36 checkpoint_logs: 3May2012 9:39:44 drop >>> 10.196.0.1 >Lan2 src: 10.230.1.4; dst: 10.196.0.68; proto: udp; >>> message: Virtual defragmentation error: Timeout; ip_id: 7132; ip_len: >>> 1432; ip_offset: 40; fragments_dropped: 2; during_sec: 60; product: >>> VPN-1 & FireWall-1; >>> >>>> Is ossec-maild running? >>> Yes, it is running. >>> >>>> Anything related to this in the ossec.log? >>> >>> No, nothing. >>> >>>> Try running the ossec processes in debug mode. >>> >>> ossec-maild?? or another?? >>>> >>>> On Thu, May 3, 2012 at 8:43 AM, C. L. Martinez <[email protected]> >>>> wrote: >>>>> Hi all, >>>>> >>>>> For what reason an ossec server can not send an email when an alert >>>>> is triggered?? After 15 days working ok, my ossec server doesn't sent >>>>> alerts after several minutes or hours when an alert is triggered. I >>>>> have configured "<do_not_delay />" and >>>>> <email_maxperhour>1000</email_maxperhour> in ossec.conf, but it >>>>> doesn't works. >>>>> >>>>> Any ideas??
