On Sat, May 5, 2012 at 9:17 AM, carlopmart <[email protected]> wrote:
> On 05/05/2012 10:34 AM, Ivan Leznjov Jr. wrote:
>>
>>
>> -----BEGIN PGP SIGNED MESSAGE-----
>> Hash: SHA1
>>
>> I've been having this problem for years, literally.
>>
>> Sometimes I just stop receiving e-mail notifications for no apparent
>> reasons. In earlier days I would start googling like mad, then get on
>> mailing list and/or IRC and actively try to find a solution (which I've
>> never really found to this date), but all I do now is I just sit back an
>> relax. After some time e-mail notifications resume showing up in my
>> inbox. This has happened many times already.
>>
>> I wish I knew why exactly that is happening. Perhaps the most meaningful
>> explanation I've heard so far was that ossec-maild is somehow not as
>> perfect as a full-blown MTA -- such as exim, postfix or monstrous
>> sendmail -- and that perhaps having one should eliminate the problem. I
>> still haven't got around to setting up and configuring properly any of
>> the MTA's on my personal notebook, but I will someday, and we'll see if
>> that changes anything.
>>
>
> Yes, I think the same: problem is with ossec-maild daemon, like occurs with
> ossec-remoted when is used to receive many many logs (in my tests when 1.5k
> events per second is reached, ossec loose a lot of events).
>
> May be these problems can be solved in next ossec release: using a real MTA
> like postfix or qmail instead of ossec-maild, and modifiying ossec-remoted
> when is used to receive alot of syslog messages using rsyslog or syslog-ng
> todo this task ...
>
>
ossec-maild would be used in combination with a real MTA. Setup an MTA
and give it a shot. We're not going to bundle postfix or qmail or
anything like that inside of OSSEC, especially when so many people
refuse to use them in the first place.
Part of the problem is that the people experiencing the issue aren't
really trying to fix it. Are you running ossec-maild in debug? If not,
what are you doing that may help track down the problem the next time
it happens?
I missed your bug report about the loose events. What did you use to
do your testing? How did you measure event loss? How many events were
lost out of how many sent? How was the environment configured?
>
>
> --
> CL Martinez
> carlopmart {at} gmail {d0t} com
