topic Not receiving alert email consistently in Alerting

Not receiving alert email consistently

ubko — Wed, 17 Nov 2010 00:40:35 GMT

I haven't found any log related to SMTP activities. And there doesn't seem to be any "smtp" or "mail" logging setting. Would starting Splunk in debug mode show SMTP activities?

Re: Not receiving alert email consistently

yannK — Wed, 17 Nov 2010 02:05:43 GMT

The mails are linked to the scheduled searches.

Check if our search worked, and returned results, if a mail was sent, and if the mail failed.

look in : $SPLUNK_HOME/var/log/splunk/scheduler.log

or do a search on :

index=_internal source="*scheduler.log*"

Re: Not receiving alert email consistently

ubko — Wed, 17 Nov 2010 04:08:04 GMT

The job did run. Only the email did not arrive.

Re: Not receiving alert email consistently

the_wolverine — Wed, 17 Nov 2010 08:08:09 GMT

I've encountered various bugs related to alerts misfiring. You should contact support and provide specific details as to version and conditions of the alert. One thing that was consistent at one time was if you were alerting on a resultset > 10000, I found that the alert would run but no email was sent. You could try updating your alert (add | head 1000, or similar) to keep the eventcount low and test to see if you get consistent alerts in this case.

Re: Not receiving alert email consistently

ubko — Wed, 17 Nov 2010 08:18:56 GMT

Thanks. My alerts report very small resultset (a few lines, no more than 100). I'll contact support.

Re: Not receiving alert email consistently

gkanapathy — Wed, 17 Nov 2010 10:10:34 GMT

The email script is actually an external search script, and the scheduler simply triggers that to send emails. It does not log all that much, but when it does, it logs to python.log. You might need to change the log level in log.cfg to see more.

Re: Not receiving alert email consistently

ubko — Thu, 18 Nov 2010 00:45:50 GMT

Thanks. Do you know what that script is called?

Re: Not receiving alert email consistently

gkanapathy — Thu, 18 Nov 2010 03:30:04 GMT

$SPLUNK_HOME/etc/apps/search/bin/sendemail.py. Don't edit that script. Instead, copy it, modify the copy, then override the filename for the sendemail command in commands.conf (with a local commands.conf, not by editing the default commands.conf).