topic Re: Hep sending alert send email configure in Alerting

Need help with configuration for email alert

bella — Fri, 18 Mar 2022 14:57:52 GMT

I need some help to check configure send email, and I still have not received the email alert in my mailbox. The alert is already triggered as I can see that in the "triggered alerts" section.
when i configure like this,and saved.

then i open again, username,passward is gone,

Re: Hep sending alert send email configure

gcusello — Fri, 18 Mar 2022 08:03:12 GMT

Hi @bella,

I suppose that you already checked that the route between your Search Head and eMail, if not, make it.

Anyway, I cannot completely understand your screenshot because I see Japanese chars, anyway, the first step is to check the eMail parameters:

url,
port,
TLS,
user needed or not,
eventually user and password.

Then check if the message and the attachment is big.

At least, you can see the Splunk logs in %SPLUNK_HOME/var/log/splunk/splunkd.log or in _internal index, searching mail errors.

Ciao.

Giuseppe

Re: Hep sending alert send email configure

bella — Fri, 18 Mar 2022 08:09:48 GMT

i can see some error ,like this:

Re: Hep sending alert send email configure

gcusello — Fri, 18 Mar 2022 08:17:05 GMT

Hi @bella,

the message says that there's an error in sendmail.

What about the other checks?

Ciao.

Giuseppe

Re: Hep sending alert send email configure

bella — Fri, 18 Mar 2022 08:38:26 GMT

Hi，@gcusello,
I test many times:
smtp.qiye.aliyun:25
null
username:null
password:null

OR

smtp.qiye.aliyun:465
SSL
username:xxxxx@vskysoft.com
password:xxxyyyy
password confirm:xxxyyyy

they all false.
when i configure username,password, saved. then i open again, username,password all gone.
like i first screenshot; I really don't understand why I can't save my configuration. where i can see my configuration in config?

Re: Hep sending alert send email configure

bella — Fri, 18 Mar 2022 09:02:22 GMT

i find the configuration,like this:

Re: Hep sending alert send email configure

gcusello — Fri, 18 Mar 2022 09:04:36 GMT

Hi @bella,

did you checked these parameters are the correct ones for your eMail system?

what about routes? usually this is the first problem.

Ciao.

Giuseppe

Re: Hep sending alert send email configure

bella — Fri, 18 Mar 2022 10:42:41 GMT

Hi,

I've tested it. The SMTP account is OK. Now I'm a little confused

Re: Hep sending alert send email configure

gcusello — Fri, 18 Mar 2022 11:16:35 GMT

hi @bella,

did you tried the connection (using telnet) from the Splunk server to the eMail server on the used port?

Ciao.

Giuseppe

Re: Hep sending alert send email configure

bella — Mon, 21 Mar 2022 07:00:19 GMT

Hi,@gcusello

I changed the version of splunk from 8.0.6 to 8.2.5, before i test in version 8.0.6,they all fail, when i test in version 8.2.5,it is success.

thank you !

bella

Re: Hep sending alert send email configure

gcusello — Mon, 21 Mar 2022 07:47:03 GMT

Hi @bella,

good for you, please accept one answer for the other people of Community, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated 😉