Setting up an alert in splunk to notify user when SMTP server is stuck

[ashwinipatil007]

Hi,
I want to setup an alert whenever SMTP server is stuck/hung i.e. when smtp is not sending alerts.

My SMTP server gets stuck certain time and wont be sending any emails until we restart the server.

so I want to setup an alert in splunk to notify me when the SMTP server is stuck.

P.S when the SMTP server is stuck no logs are generated so there is no such specific error messages.

so let me know if there is any way to setup an alert.

thanks:)

[darrenfuller]

how about :

index=smtpindex sourcetype=smtpsourcetype earliest=-10m
| stats count 
| search count=0

Save that as an alert
set "Trigger alert when" "Number of events" > 0.

Add a schedule to the alert
and add some action (ie send an email)
and you're done.

Hope this helps...

./D

[ashwinipatil007]

SMTP server is not in my splunk environment,it is present some other teams environment.

so" index=smtpindex sourcetype=smtpsourcetype" I wont be able to give this index and sourcetype as I have not created any index as smtpindex

correct me if I am wrong

[Deexeh]

If the system isn't splunked, do you have a forwarder that is able to ping it?

Could try a scripted input by writing a simple sh or powershell script, which pings the device to see if it's online?

https://docs.splunk.com/Documentation/SplunkCloud/8.0.2001/AdvancedDev/ScriptSetup

[ashwinipatil007]

yes I have forwader which monitors the SMTP system