Alerting

Setting up an alert in splunk to notify user when SMTP server is stuck

New Member

Hi,
I want to setup an alert whenever SMTP server is stuck/hung i.e. when smtp is not sending alerts.

My SMTP server gets stuck certain time and wont be sending any emails until we restart the server.

so I want to setup an alert in splunk to notify me when the SMTP server is stuck.

P.S when the SMTP server is stuck no logs are generated so there is no such specific error messages.

so let me know if there is any way to setup an alert.

thanks:)

Labels (2)
0 Karma
Highlighted

Re: Setting up an alert in splunk to notify user when SMTP server is stuck

Contributor

how about :

index=smtpindex sourcetype=smtpsourcetype earliest=-10m
| stats count 
| search count=0

Save that as an alert
set "Trigger alert when" "Number of events" > 0.

Add a schedule to the alert
and add some action (ie send an email)
and you're done.

Hope this helps...

./D

0 Karma
Highlighted

Re: Setting up an alert in splunk to notify user when SMTP server is stuck

New Member

SMTP server is not in my splunk environment,it is present some other teams environment.

so" index=smtpindex sourcetype=smtpsourcetype" I wont be able to give this index and sourcetype as I have not created any index as smtpindex

correct me if I am wrong

0 Karma
Highlighted

Re: Setting up an alert in splunk to notify user when SMTP server is stuck

New Member

If the system isn't splunked, do you have a forwarder that is able to ping it?

Could try a scripted input by writing a simple sh or powershell script, which pings the device to see if it's online?

https://docs.splunk.com/Documentation/SplunkCloud/8.0.2001/AdvancedDev/ScriptSetup

0 Karma
Highlighted

Re: Setting up an alert in splunk to notify user when SMTP server is stuck

New Member

yes I have forwader which monitors the SMTP system

0 Karma