topic Re: troubleshooting mailclient in All Apps and Add-ons

troubleshooting mailclient

jibanes — Tue, 20 Sep 2016 14:17:40 GMT

TA-mailclient should output to splunkd.log the result of POP/IMAP connections, in order to troubleshoot errors; or simply alert a user if his password is no longer valid or simply if mailclient wasn't able to retrieve emails.

Re: troubleshooting mailclient

jibanes — Tue, 20 Sep 2016 15:47:15 GMT

09-20-2016 15:45:00.279 +0000 INFO ExecProcessor - message from "python /opt/splunk/etc/apps/TA-mailclient/bin/mail.py" Got credentials from endpoint - Username(xxx@gmail.com)

This unfortunately, is the only message I get from TA-mailclient, I don't see any mail going in the index, nor I know what made it fail to do so.

Re: troubleshooting mailclient

jibanes — Tue, 20 Sep 2016 16:16:02 GMT

maybe there's a debug mode or something that would help.

Re: troubleshooting mailclient

seunomosowon — Wed, 21 Sep 2016 11:09:46 GMT

Hi Jibanes,

I'll add this in over the next week and test, and I'll release an update. It'll log as INFO. Should also include support for more special characters in the password field.

Cheers

Re: troubleshooting mailclient

jibanes — Wed, 21 Sep 2016 13:25:15 GMT

Thanks a lot, much appreciated; this is a great app.

Re: troubleshooting mailclient

seunomosowon — Thu, 29 Sep 2016 17:57:10 GMT

Yes, I'm currently testing, and should put this up today or tomorrow.

Thanks again.

Re: troubleshooting mailclient

jibanes — Thu, 29 Sep 2016 17:57:13 GMT

did you have a chance to look into this?

Re: troubleshooting mailclient

jibanes — Thu, 29 Sep 2016 17:58:25 GMT

Thanks will test

Re: troubleshooting mailclient

seunomosowon — Tue, 29 Sep 2020 11:12:22 GMT

Hi Jibanes,

I've uploaded an update. This should be fixed now. All exceptions will now be handled in someway, and you should find login failures with :
index=_internal sourcetype=splunkd component=ExecProcessor mail.py log_level=INFO

Re: troubleshooting mailclient

seunomosowon — Mon, 03 Oct 2016 12:37:43 GMT

Do let me know how you get along with the update.

Re: troubleshooting mailclient

jibanes — Mon, 03 Oct 2016 16:09:46 GMT

10-03-2016 16:05:02.937 +0000 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/TA-mailclient/bin/mail.py" ERRORlocal variable 'e' referenced before assignment

Re: troubleshooting mailclient

jibanes — Mon, 03 Oct 2016 16:19:59 GMT

I'm running Splunk 6.5.0 now btw.

Re: troubleshooting mailclient

seunomosowon — Mon, 03 Oct 2016 16:30:07 GMT

Yeah. One minute. my error.Will re-load in 5

Re: troubleshooting mailclient

jibanes — Mon, 03 Oct 2016 16:32:20 GMT

thanks, let me know.

Re: troubleshooting mailclient

seunomosowon — Mon, 03 Oct 2016 16:35:08 GMT

Fixed and tested. Uploaded 0.4.8

Re: troubleshooting mailclient

jibanes — Mon, 03 Oct 2016 17:53:12 GMT

This error doesn't show up anymore, but index=mail is still empty, and while mail.py is scheduled to run, it doesn't seem to error (it just INFO when it starts); would you have the magic string to run it from command line perhaps?

tcpdump on the imap port shows that the communication is established (in my case with imap.google.com) but ends up after a few seconds; it's SSL so I can't easily know what went through in the exchange itself.

Re: troubleshooting mailclient

jibanes — Mon, 03 Oct 2016 17:57:17 GMT

sorry I meant imap.gmail.com

Re: troubleshooting mailclient

seunomosowon — Mon, 03 Oct 2016 18:01:46 GMT

I just tried it on mine for POP3 and IMAP, and it works alright. What interval do you have the input setup to poll the server?

Re: troubleshooting mailclient

jibanes — Mon, 03 Oct 2016 18:08:46 GMT

I just moved it to every 15 minutes for troubleshooting; but there's not much to troubleshoot.

Re: troubleshooting mailclient

seunomosowon — Tue, 29 Sep 2020 11:16:19 GMT

Nothing shows when you do this?
index=_internal sourcetype=splunkd component=ExecProcessor mail.py log_level=INFO?

I'll try this using this for a gmail account tonight. And let you know if i find any issues using gmail.