topic Re: E-mail alerts stopped working since 6.6 upgrade for some users in Alerting

E-mail alerts stopped working since 6.6 upgrade for some users

tin_fish — Tue, 16 May 2017 14:02:07 GMT

Following upgrade to Splunk Enterprise 6.6, some of my users' scheduled e-mail reports are no longer working. Admins seem fine, but others not so. Seeing errors like this in python.log:

2017-05-16 09:22:43,543 +0100 ERROR ssl_context:638 - SSLHelper.getServerSettings Could not access or parse sslConfig stanza of server.conf. Error=[HTTP 403] Client is not authorized to perform requested action; https://127.0.0.1:8089/services/configs/conf-server/sslConfig
2017-05-16 09:22:43,543 +0100 ERROR sendemail:137 - Sending email. subject=“#######”, server="127.0.0.1:25"
2017-05-16 09:22:43,543 +0100 ERROR sendemail:443 - 'rootCAPath' while sending mail to: ########

Re: E-mail alerts stopped working since 6.6 upgrade for some users

mafisher_splunk — Tue, 16 May 2017 14:03:44 GMT

You need to give your users the 'list_settings' capability; that was introduced in Splunk 6.6 part of Common Criteria (ISO/IEC 15408) compliance, so alert-sending has access to SSL configurations.

Re: E-mail alerts stopped working since 6.6 upgrade for some users

mugundanava — Thu, 25 May 2017 19:58:08 GMT

where to give "users the 'list_settings' capability"

Re: E-mail alerts stopped working since 6.6 upgrade for some users

mafisher_splunk — Fri, 26 May 2017 08:44:37 GMT

You can add capabilities under Roles.

Re: E-mail alerts stopped working since 6.6 upgrade for some users

hharris — Wed, 12 Jul 2017 17:59:12 GMT

I have followed the suggested resolution with no success. Is there any other suggestions for restoring Emailing alerts (using TLS) after upgrade to 6.6.2? Email isn't working for Admin, Power users, or Users.

Re: E-mail alerts stopped working since 6.6 upgrade for some users

usd0872 — Tue, 19 Dec 2017 10:23:33 GMT

Works. Thanks for the info.

(Not really happy, though, to give our normal users a capability which, by default, is admin-only...)

Re: E-mail alerts stopped working since 6.6 upgrade for some users

the_wolverine — Mon, 09 Apr 2018 19:03:50 GMT

It seems like mafisher has posted the resolution for this issue. We upgraded to version 7 and had the same issue with failed email alerts. Splunk should have documented this change to capabilities in the README.

Re: E-mail alerts stopped working since 6.6 upgrade for some users

gstultz_splunk — Tue, 07 Jul 2020 14:40:28 GMT

According to the roles/capabilities definition of "list_settings" this gives users 'Lets the user list and view server and introspection settings such as the server name, log levels, etc'. Since this is default an admin capability, how much of a vulnerability is this if a user is allowed the same capability?

Re: E-mail alerts stopped working since 6.6 upgrade for some users

andygerberkp — Wed, 16 Sep 2020 20:44:00 GMT

This is the solution from Splunk as well:

https://splunkcommunities.force.com/customers/apex/ArticleDetailPage?URLName=Scheduled-Search-Alert-not-Triggering-Emails