Double check the smtp server's mail logs to make sure nothing funky is going on. Does restarting the ossec-maild process help?
On Thu, May 3, 2012 at 9:38 AM, C. L. Martinez <[email protected]> wrote: > According to last statistic from smtp server, ossec server have sended > 675 emails ... > > Config: > > <ossec_config> > <global> > <email_notification>yes</email_notification> > <smtp_server>10.196.35.110</smtp_server> > <email_to>[email protected]</email_to> > <email_from>[email protected]</email_from> > <email_maxperhour>1000</email_maxperhour> > </global> > > <email_alerts> > <level>7</level> > <email_to>[email protected]</email_to> > <do_not_delay /> > <do_not_group /> > </email_alerts> > > On Thu, May 3, 2012 at 3:32 PM, dan (ddp) <[email protected]> wrote: >> And you're definitely not hitting the 1000 mail limit? >> What is your configuration exactly? >> >> On Thu, May 3, 2012 at 9:14 AM, C. L. Martinez <[email protected]> wrote: >>> I have do it and no traffic appears when an alert is triggered, >>> according to alerts.log ... >>> >>> >>> On Thu, May 3, 2012 at 3:11 PM, dan (ddp) <[email protected]> wrote: >>>> Oh, also run tcpdump to look at port 25 traffic to see if ossec-maild >>>> is trying to send email. >>>> >>>> On Thu, May 3, 2012 at 9:07 AM, C. L. Martinez <[email protected]> >>>> wrote: >>>>> On Thu, May 3, 2012 at 2:57 PM, dan (ddp) <[email protected]> wrote: >>>>>> You're currently getting no emails at all? >>>>> Correct. >>>>> >>>>>> Are alerts actually being triggered? >>>>> Yes, for example: >>>>> >>>>> ** Alert 1336031183.72054663: mail - cpfirewall,cpfirewall_virtualdefrag, >>>>> 2012 May 03 09:46:23 (plzfsgsip01.adsi.intranet.local) >>>>> 10.196.0.90->/data/logs/chkp.log >>>>> Rule: 100106 (level 7) -> 'CheckPoint Firewall-1 alert by Virtual >>>>> defragmentation error.' >>>>> Src IP: 10.230.1.4 >>>>> Dst IP: 10.196.0.68 >>>>> May 3 09:46:22 10.196.0.36 checkpoint_logs: 3May2012 9:39:44 drop >>>>> 10.196.0.1 >Lan2 src: 10.230.1.4; dst: 10.196.0.68; proto: udp; >>>>> message: Virtual defragmentation error: Timeout; ip_id: 7132; ip_len: >>>>> 1432; ip_offset: 40; fragments_dropped: 2; during_sec: 60; product: >>>>> VPN-1 & FireWall-1; >>>>> >>>>>> Is ossec-maild running? >>>>> Yes, it is running. >>>>> >>>>>> Anything related to this in the ossec.log? >>>>> >>>>> No, nothing. >>>>> >>>>>> Try running the ossec processes in debug mode. >>>>> >>>>> ossec-maild?? or another?? >>>>>> >>>>>> On Thu, May 3, 2012 at 8:43 AM, C. L. Martinez <[email protected]> >>>>>> wrote: >>>>>>> Hi all, >>>>>>> >>>>>>> For what reason an ossec server can not send an email when an alert >>>>>>> is triggered?? After 15 days working ok, my ossec server doesn't sent >>>>>>> alerts after several minutes or hours when an alert is triggered. I >>>>>>> have configured "<do_not_delay />" and >>>>>>> <email_maxperhour>1000</email_maxperhour> in ossec.conf, but it >>>>>>> doesn't works. >>>>>>> >>>>>>> Any ideas??
