On Sun, Dec 20, 2015 at 7:50 AM, theresa mic-snare <[email protected]> wrote: > Hi everyone, > > today I've noticed a problem with the ossec-maild process. > The ossec.log keeps saying > > ossec-maild(1223): ERROR: Error Sending email to 127.0.0.1 (smtp server) > > Of course I started troubleshooting the problem and tried to send several > test-emails from the ossec master. > I'm using ssmtp through my google-mail account by the way. > All test mails that I sent arrived immediately, so sending mails through my > MTA seems to work as usual. > > Then I checked the mail log /var/log/maillog-20151220 > which to my surprise has the latest mail entry from yesterday 19:30 > Dec 19 19:30:03 tron sSMTP[3943]: Sent mail for [email protected] (221 2.0.0 > closing connection u126sm11888435wme.3 - gsmtp) uid=48 username=apache > outbytes=1898 > > changed the email address to [email protected] for demonstration purposes... > > > at least the two test emails that I just send should appear in this log, > right? > > I know that the root cause to this problem is NOT an ossec problem....but > maybe you have an idea what the problem might be? > I've checked the quota settings in my gmail account, (so far only 10% > used...) > I've also checked the disk space on my ossec master, still 21GB left on / > (where also /var is mounted) > > so I doubt it's a quota or diskspace problem. > i've also restarted (stopped and started) ossec, to see if any zombie > processes still allocated the filesystem, and it therefore showed that > plenty of diskspace was available. > but even after the restart of ossec it still shows that it has plenty of > diskspace available. > > any other ideas how I could troubleshoot this problem? >
Make sure ssmtp is still listening on 127.0.0.1. Use tcpdump or something similar to sniff the traffic between ossec-maild and ssmtp. Turn on debugging on ssmtp? > thanks, > theresa > > -- > > --- > You received this message because you are subscribed to the Google Groups > "ossec-list" group. > To unsubscribe from this group and stop receiving emails from it, send an > email to [email protected]. > For more options, visit https://groups.google.com/d/optout. -- --- You received this message because you are subscribed to the Google Groups "ossec-list" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. For more options, visit https://groups.google.com/d/optout.
