According to last statistic from smtp server, ossec server have sended
675 emails ...
Config:
<ossec_config>
<global>
<email_notification>yes</email_notification>
<smtp_server>10.196.35.110</smtp_server>
<email_to>[email protected]</email_to>
<email_from>[email protected]</email_from>
<email_maxperhour>1000</email_maxperhour>
</global>
<email_alerts>
<level>7</level>
<email_to>[email protected]</email_to>
<do_not_delay />
<do_not_group />
</email_alerts>
On Thu, May 3, 2012 at 3:32 PM, dan (ddp) <[email protected]> wrote:
> And you're definitely not hitting the 1000 mail limit?
> What is your configuration exactly?
>
> On Thu, May 3, 2012 at 9:14 AM, C. L. Martinez <[email protected]> wrote:
>> I have do it and no traffic appears when an alert is triggered,
>> according to alerts.log ...
>>
>>
>> On Thu, May 3, 2012 at 3:11 PM, dan (ddp) <[email protected]> wrote:
>>> Oh, also run tcpdump to look at port 25 traffic to see if ossec-maild
>>> is trying to send email.
>>>
>>> On Thu, May 3, 2012 at 9:07 AM, C. L. Martinez <[email protected]> wrote:
>>>> On Thu, May 3, 2012 at 2:57 PM, dan (ddp) <[email protected]> wrote:
>>>>> You're currently getting no emails at all?
>>>> Correct.
>>>>
>>>>> Are alerts actually being triggered?
>>>> Yes, for example:
>>>>
>>>> ** Alert 1336031183.72054663: mail - cpfirewall,cpfirewall_virtualdefrag,
>>>> 2012 May 03 09:46:23 (plzfsgsip01.adsi.intranet.local)
>>>> 10.196.0.90->/data/logs/chkp.log
>>>> Rule: 100106 (level 7) -> 'CheckPoint Firewall-1 alert by Virtual
>>>> defragmentation error.'
>>>> Src IP: 10.230.1.4
>>>> Dst IP: 10.196.0.68
>>>> May 3 09:46:22 10.196.0.36 checkpoint_logs: 3May2012 9:39:44 drop
>>>> 10.196.0.1 >Lan2 src: 10.230.1.4; dst: 10.196.0.68; proto: udp;
>>>> message: Virtual defragmentation error: Timeout; ip_id: 7132; ip_len:
>>>> 1432; ip_offset: 40; fragments_dropped: 2; during_sec: 60; product:
>>>> VPN-1 & FireWall-1;
>>>>
>>>>> Is ossec-maild running?
>>>> Yes, it is running.
>>>>
>>>>> Anything related to this in the ossec.log?
>>>>
>>>> No, nothing.
>>>>
>>>>> Try running the ossec processes in debug mode.
>>>>
>>>> ossec-maild?? or another??
>>>>>
>>>>> On Thu, May 3, 2012 at 8:43 AM, C. L. Martinez <[email protected]>
>>>>> wrote:
>>>>>> Hi all,
>>>>>>
>>>>>> For what reason an ossec server can not send an email when an alert
>>>>>> is triggered?? After 15 days working ok, my ossec server doesn't sent
>>>>>> alerts after several minutes or hours when an alert is triggered. I
>>>>>> have configured "<do_not_delay />" and
>>>>>> <email_maxperhour>1000</email_maxperhour> in ossec.conf, but it
>>>>>> doesn't works.
>>>>>>
>>>>>> Any ideas??
