topic Re: Why is sendemail not using correct mailserver? in Alerting

Why is sendemail not using correct mailserver?

davidblader — Thu, 06 Feb 2020 20:25:20 GMT

Hello,

I've been trying to get my splunk instance to send out email alerts using Amazon SES SMTP server without much luck.

The error in my python.log file seems to suggest that it is not collecting the correct server I have configured under Settings -> Server settings -> Email settings - or alert_actions.conf

The error being:
ERROR sendemail:142 - Sending email. ... server="localhost" ERROR sendemail:473 - [Errno 111] Connection refused while sending mail to: email@domain.com

oddly enough, it gathers email@domain.com just fine as defined in my alert definition.

I've seen other posts on here suggesting that values in savedsearches.conf can override the action.email.mailserver configuration, but I see no such file in my local config directory or any other suggestion of a conflict for action.email.mailserver

Re: Why is sendemail not using correct mailserver?

PavelP — Thu, 06 Feb 2020 21:18:13 GMT

you can check with btool if some app override the setting by unsetting the value:

  /opt/splunk/bin/splunk btool savesearches list --debug|grep mailserver

  /opt/splunk/bin/splunk btool alert_actions list --debug|grep mailserver

savedsearches.conf:

action.email.mailserver = <string>
* Set the address of the MTA server to be used to send the emails.
* Defaults to <LOCALHOST>
    (or the 'mailserver' setting in alert_actions.conf file)

alert_actions.conf:

mailserver = <host>[:<port>]
* You must have a Simple Mail Transfer Protocol (SMTP) server available
  to send email. This is not included with Splunk.
* Specifies the SMTP mail server to use when sending emails.
* <host> can be either the hostname or the IP address.
* Optionally, specify the SMTP <port> that Splunk should connect to.
* When the 'use_ssl' setting (see below) is set to 1 (true), you
  must specify both <host> and <port>.
  (Example: "example.com:465")
* Default: $LOCALHOST:25

Re: Why is sendemail not using correct mailserver?

davidblader — Thu, 06 Feb 2020 21:41:07 GMT

Hey, thanks for the response!

running these both gave me

/opt/splunk/bin/splunkd: error while loading shared libraries: libjemalloc.so.2: cannot open shared object file: No such file or directory

EDIT: Disregard, misread the commands you provided. no results for the first command, the second command spits out the correct smtp server that I'm expecting. No overwrites.

Re: Why is sendemail not using correct mailserver?

PavelP — Tue, 11 Feb 2020 07:56:28 GMT

does setting smtp server in savedsearches.conf helps?