On Thu, May 3, 2012 at 4:15 PM, dan (ddp) <[email protected]> wrote: > Double check the smtp server's mail logs to make sure nothing funky is going > on. > Does restarting the ossec-maild process help?
Uhmm, yes ... I seems that works now ... Ok, I will try to detect if the problem is on the smtp server side ... Thanks to all. > > On Thu, May 3, 2012 at 9:38 AM, C. L. Martinez <[email protected]> wrote: >> According to last statistic from smtp server, ossec server have sended >> 675 emails ... >> >> Config: >> >> <ossec_config> >> <global> >> <email_notification>yes</email_notification> >> <smtp_server>10.196.35.110</smtp_server> >> <email_to>[email protected]</email_to> >> <email_from>[email protected]</email_from> >> <email_maxperhour>1000</email_maxperhour> >> </global> >> >> <email_alerts> >> <level>7</level> >> <email_to>[email protected]</email_to> >> <do_not_delay /> >> <do_not_group /> >> </email_alerts> >> >> On Thu, May 3, 2012 at 3:32 PM, dan (ddp) <[email protected]> wrote: >>> And you're definitely not hitting the 1000 mail limit? >>> What is your configuration exactly? >>> >>> On Thu, May 3, 2012 at 9:14 AM, C. L. Martinez <[email protected]> wrote: >>>> I have do it and no traffic appears when an alert is triggered, >>>> according to alerts.log ... >>>> >>>> >>>> On Thu, May 3, 2012 at 3:11 PM, dan (ddp) <[email protected]> wrote: >>>>> Oh, also run tcpdump to look at port 25 traffic to see if ossec-maild >>>>> is trying to send email. >>>>> >>>>> On Thu, May 3, 2012 at 9:07 AM, C. L. Martinez <[email protected]> >>>>> wrote: >>>>>> On Thu, May 3, 2012 at 2:57 PM, dan (ddp) <[email protected]> wrote: >>>>>>> You're currently getting no emails at all? >>>>>> Correct. >>>>>> >>>>>>> Are alerts actually being triggered? >>>>>> Yes, for example: >>>>>> >>>>>> ** Alert 1336031183.72054663: mail - >>>>>> cpfirewall,cpfirewall_virtualdefrag, >>>>>> 2012 May 03 09:46:23 (plzfsgsip01.adsi.intranet.local) >>>>>> 10.196.0.90->/data/logs/chkp.log >>>>>> Rule: 100106 (level 7) -> 'CheckPoint Firewall-1 alert by Virtual >>>>>> defragmentation error.' >>>>>> Src IP: 10.230.1.4 >>>>>> Dst IP: 10.196.0.68 >>>>>> May 3 09:46:22 10.196.0.36 checkpoint_logs: 3May2012 9:39:44 drop >>>>>> 10.196.0.1 >Lan2 src: 10.230.1.4; dst: 10.196.0.68; proto: udp; >>>>>> message: Virtual defragmentation error: Timeout; ip_id: 7132; ip_len: >>>>>> 1432; ip_offset: 40; fragments_dropped: 2; during_sec: 60; product: >>>>>> VPN-1 & FireWall-1; >>>>>> >>>>>>> Is ossec-maild running? >>>>>> Yes, it is running. >>>>>> >>>>>>> Anything related to this in the ossec.log? >>>>>> >>>>>> No, nothing. >>>>>> >>>>>>> Try running the ossec processes in debug mode. >>>>>> >>>>>> ossec-maild?? or another?? >>>>>>> >>>>>>> On Thu, May 3, 2012 at 8:43 AM, C. L. Martinez <[email protected]> >>>>>>> wrote: >>>>>>>> Hi all, >>>>>>>> >>>>>>>> For what reason an ossec server can not send an email when an alert >>>>>>>> is triggered?? After 15 days working ok, my ossec server doesn't sent >>>>>>>> alerts after several minutes or hours when an alert is triggered. I >>>>>>>> have configured "<do_not_delay />" and >>>>>>>> <email_maxperhour>1000</email_maxperhour> in ossec.conf, but it >>>>>>>> doesn't works. >>>>>>>> >>>>>>>> Any ideas??
