topic Re: Email alerts won’t send from splunk in Alerting

Email alerts won’t send from splunk

indeed_2000 — Thu, 16 Jan 2020 17:47:18 GMT

Hi
Email alert won’t send from splunk

Here is the log:

 2020-01-16 21:04:53,865 +0330  ERROR     sendemail:392 - No suitable authentication method found. while sending mail to: admin@net.net

2020-01-16 21:04:53,865 +0330 ERROR     sendemail:127 - Sending email. subject="Splunk Alert: Alert", results_link="***", recipients="[u'admin@net.net']", server="192.168.1.1"

2020-01-16 21:04:53,867 +0330 ERROR     sendemail:392 - No suitable authentication method found. while sending mail to: admin@net.net

Here is the config:

Any recommendation?
Thanks,

Re: Email alerts won’t send from splunk

rigoreatigax — Thu, 16 Jan 2020 17:51:17 GMT

Try disabling email security
Check any port restrictions.

Re: Email alerts won’t send from splunk

indeed_2000 — Thu, 16 Jan 2020 18:49:53 GMT

How can I disable it?
There is no port restriction.

Re: Email alerts won’t send from splunk

dindu — Thu, 16 Jan 2020 21:40:47 GMT

Hi,

Please try the below workarounds and let us know.

Just choose None in option and try as in the attachment.
If it did not work remove the username and password as well and try again.

Re: Email alerts won’t send from splunk

indeed_2000 — Fri, 17 Jan 2020 07:54:42 GMT

Done, problem still remain.
Interesting point is when i try to change server from ip to name, in log file still try to connect ip!

It seems server configuration freeze!

I try to restart splunkd but problem still remain.

Any recommendation?

Re: Email alerts won’t send from splunk

PavelP — Fri, 17 Jan 2020 10:52:09 GMT

as suggested by @rigoreatigax you need to ask mail server admin to modify or disable the SMTP authentication for your splunk server IP address. You can also download swaks (https://www.jetmore.org/john/code/swaks/) and find out the right TLS/SSL port and auth settings.

Re: Email alerts won’t send from splunk

indeed_2000 — Fri, 17 Jan 2020 11:04:54 GMT

I have several applications like Jira that use this mail server, and work correctly.
I only enter ip&port + user&pass in those applications and they send notifications.

Re: Email alerts won’t send from splunk

PavelP — Fri, 17 Jan 2020 13:03:57 GMT

Click Settings > Server settings > Server logging and change "EmailSender" log channel to DEBUG.
Then trigger an alert and check splunkd.log.

Capture the smtp traffic on the splunk host and jira with "tcpdump -pnns0 -i any host 192.168.1.xx and port 465 -w /tmp/smtp.pcap" and compare them using Wireshark. This will not help if all the communication is encrypted with SSL/TLS/STARTTLS.

Also ask mail server admin for assistance - he can see the exact reason in the mail server log

Re: Email alerts won’t send from splunk

indeed_2000 — Fri, 17 Jan 2020 13:06:48 GMT

Interesting point is when i try to change server from ip to name, in log file still try to connect ip!

It seems server configuration freeze!

I try to restart splunkd but problem still remain.

Any recommendation?