-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 I've been having this problem for years, literally.
Sometimes I just stop receiving e-mail notifications for no apparent reasons. In earlier days I would start googling like mad, then get on mailing list and/or IRC and actively try to find a solution (which I've never really found to this date), but all I do now is I just sit back an relax. After some time e-mail notifications resume showing up in my inbox. This has happened many times already. I wish I knew why exactly that is happening. Perhaps the most meaningful explanation I've heard so far was that ossec-maild is somehow not as perfect as a full-blown MTA -- such as exim, postfix or monstrous sendmail -- and that perhaps having one should eliminate the problem. I still haven't got around to setting up and configuring properly any of the MTA's on my personal notebook, but I will someday, and we'll see if that changes anything. On 05/03/2012 05:17 PM, C. L. Martinez wrote: > On Thu, May 3, 2012 at 4:15 PM, dan (ddp) <[email protected]> wrote: >> Double check the smtp server's mail logs to make sure nothing funky is going on. >> Does restarting the ossec-maild process help? > > Uhmm, yes ... I seems that works now ... Ok, I will try to detect if > the problem is on the smtp server side ... > > Thanks to all. > >> >> On Thu, May 3, 2012 at 9:38 AM, C. L. Martinez <[email protected]> wrote: >>> According to last statistic from smtp server, ossec server have sended >>> 675 emails ... >>> >>> Config: >>> >>> <ossec_config> >>> <global> >>> <email_notification>yes</email_notification> >>> <smtp_server>10.196.35.110</smtp_server> >>> <email_to>[email protected]</email_to> >>> <email_from>[email protected]</email_from> >>> <email_maxperhour>1000</email_maxperhour> >>> </global> >>> >>> <email_alerts> >>> <level>7</level> >>> <email_to>[email protected]</email_to> >>> <do_not_delay /> >>> <do_not_group /> >>> </email_alerts> >>> >>> On Thu, May 3, 2012 at 3:32 PM, dan (ddp) <[email protected]> wrote: >>>> And you're definitely not hitting the 1000 mail limit? >>>> What is your configuration exactly? >>>> >>>> On Thu, May 3, 2012 at 9:14 AM, C. L. Martinez <[email protected]> wrote: >>>>> I have do it and no traffic appears when an alert is triggered, >>>>> according to alerts.log ... >>>>> >>>>> >>>>> On Thu, May 3, 2012 at 3:11 PM, dan (ddp) <[email protected]> wrote: >>>>>> Oh, also run tcpdump to look at port 25 traffic to see if ossec-maild >>>>>> is trying to send email. >>>>>> >>>>>> On Thu, May 3, 2012 at 9:07 AM, C. L. Martinez <[email protected]> wrote: >>>>>>> On Thu, May 3, 2012 at 2:57 PM, dan (ddp) <[email protected]> wrote: >>>>>>>> You're currently getting no emails at all? >>>>>>> Correct. >>>>>>> >>>>>>>> Are alerts actually being triggered? >>>>>>> Yes, for example: >>>>>>> >>>>>>> ** Alert 1336031183.72054663: mail - cpfirewall,cpfirewall_virtualdefrag, >>>>>>> 2012 May 03 09:46:23 (plzfsgsip01.adsi.intranet.local) >>>>>>> 10.196.0.90->/data/logs/chkp.log >>>>>>> Rule: 100106 (level 7) -> 'CheckPoint Firewall-1 alert by Virtual >>>>>>> defragmentation error.' >>>>>>> Src IP: 10.230.1.4 >>>>>>> Dst IP: 10.196.0.68 >>>>>>> May 3 09:46:22 10.196.0.36 checkpoint_logs: 3May2012 9:39:44 drop >>>>>>> 10.196.0.1 >Lan2 src: 10.230.1.4; dst: 10.196.0.68; proto: udp; >>>>>>> message: Virtual defragmentation error: Timeout; ip_id: 7132; ip_len: >>>>>>> 1432; ip_offset: 40; fragments_dropped: 2; during_sec: 60; product: >>>>>>> VPN-1 & FireWall-1; >>>>>>> >>>>>>>> Is ossec-maild running? >>>>>>> Yes, it is running. >>>>>>> >>>>>>>> Anything related to this in the ossec.log? >>>>>>> >>>>>>> No, nothing. >>>>>>> >>>>>>>> Try running the ossec processes in debug mode. >>>>>>> >>>>>>> ossec-maild?? or another?? >>>>>>>> >>>>>>>> On Thu, May 3, 2012 at 8:43 AM, C. L. Martinez <[email protected]> wrote: >>>>>>>>> Hi all, >>>>>>>>> >>>>>>>>> For what reason an ossec server can not send an email when an alert >>>>>>>>> is triggered?? After 15 days working ok, my ossec server doesn't sent >>>>>>>>> alerts after several minutes or hours when an alert is triggered. I >>>>>>>>> have configured "<do_not_delay />" and >>>>>>>>> <email_maxperhour>1000</email_maxperhour> in ossec.conf, but it >>>>>>>>> doesn't works. >>>>>>>>> >>>>>>>>> Any ideas?? - -- With respect, Ivan Lezhnjov Jr. E-mail/Jabber: [email protected] Phone: +38 050 7780899 Key ID: 0x5811D90C Key Fingerprint: 2A52 5C8C 38BE C04F D8DE A169 19E2 E49A 5811 D90C -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.11 (GNU/Linux) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/ iEYEARECAAYFAk+k5hMACgkQGeLkmlgR2QzOMgCeKuHpE2fM+ffo3YVEmMJUlMRG d0QAn2LaIhiFro57CrmGT2SXBk79fm6X =5Z+F -----END PGP SIGNATURE-----
