On 05/05/2012 10:34 AM, Ivan Leznjov Jr. wrote:
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
I've been having this problem for years, literally.
Sometimes I just stop receiving e-mail notifications for no apparent
reasons. In earlier days I would start googling like mad, then get on
mailing list and/or IRC and actively try to find a solution (which I've
never really found to this date), but all I do now is I just sit back an
relax. After some time e-mail notifications resume showing up in my
inbox. This has happened many times already.
I wish I knew why exactly that is happening. Perhaps the most meaningful
explanation I've heard so far was that ossec-maild is somehow not as
perfect as a full-blown MTA -- such as exim, postfix or monstrous
sendmail -- and that perhaps having one should eliminate the problem. I
still haven't got around to setting up and configuring properly any of
the MTA's on my personal notebook, but I will someday, and we'll see if
that changes anything.
Yes, I think the same: problem is with ossec-maild daemon, like occurs
with ossec-remoted when is used to receive many many logs (in my tests
when 1.5k events per second is reached, ossec loose a lot of events).
May be these problems can be solved in next ossec release: using a real
MTA like postfix or qmail instead of ossec-maild, and modifiying
ossec-remoted when is used to receive alot of syslog messages using
rsyslog or syslog-ng todo this task ...
--
CL Martinez
carlopmart {at} gmail {d0t} com
