Alerting

Email action for alerts no longer works since Splunk 7.3.6

HumanPrinter
Explorer

Last week we upgraded our Splunk-cluster from version 7.3.5 to 7.3.6. Since that moment, alerts that are triggered no longer are able to send mail.

The _internal index shows an event stating "ERROR sendemail:461 - 'rootCAPath' while sending mail to: xxx@xx"

From other posts it seems to be required to add the list_settings capability to our user roles. However, prior to the update we have had no problems with alert mails without adding this capability to user roles. The release notes for version 7.3.6 don't mention any fix or change in this regard.

Since the documentation is not quite clear about the impact of adding this capability to a user role (what additional possibilities are available to users with this capability) and this didn't seem to be required up until version 7.3.5 we would like to be sure this capability won't harm our setup

Labels (2)
0 Karma
1 Solution

lweiss
Explorer

Hi @muhammadamir 

This is a known issue with v7.3.6; we ran into it at my company when we upgraded. 

To resolve the problem you'll need to add the "admin_all_objects" capability to anyone that needs to send an email alert. There's more info about the issue in the release notes:  Known issues - Splunk Documentation

Good luck!

 

 

View solution in original post

0 Karma

burwell
SplunkTrust
SplunkTrust

Hi. I had the same question of Splunk support.  I had asked ffor documentation clarification but it doesn't seem to have made it into this documentation https://docs.splunk.com/Documentation/Splunk/8.2.0/Admin/authorizeconf

Support told me that list_settings allows a user to have access to settings endpoint.

| rest splunk_server=local /services/server/settings

We added it for our users.

0 Karma

muhammadamir
New Member

Hi Support, did any body a solution for it. I Just upgrade my splunk from 7.2.2 to 7.3 it works fine, but after this version the email alerts doesn't work. Did anybody able to resolve this issue. Please, let me know ASAP. Thanks.

0 Karma

lweiss
Explorer

Hi @muhammadamir 

This is a known issue with v7.3.6; we ran into it at my company when we upgraded. 

To resolve the problem you'll need to add the "admin_all_objects" capability to anyone that needs to send an email alert. There's more info about the issue in the release notes:  Known issues - Splunk Documentation

Good luck!

 

 

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...