Alerting

Why are we getting "error writing message: file too large", causing email alerts to not get sent out to users?

bharathkumarnec
Communicator

Hi All,

Today my users are claiming that they are not receiving email alerts from Splunk. Below are the steps taken to verify the same:

1) Verified in triggered alerts -- I see a count in triggered alerts
2) Verified python.log -- didn't find any errors, but I see events that say email sent to so and so address.

When I check the Linux email log \var\log\maillog, I found this error message:

postfix/local[number]: number:to =<xyz.localdomain>,orig_to=<splunk>, relay=local,delay=0.1,dsn=X.Y.Z,status=bounced (cannot update mailbox /var/mai/splunk for splunk. error writing message: file too large)

Is this related to size of the email?
Is this problem with SMTP?
I see CHMOD errors in \var\mail\splunk....

Any one faced this kind of situation, help in this regard is highly helpful.

Thanks in advance!

0 Karma
1 Solution

bharathkumarnec
Communicator

Hi All,,

Issue got resolved, looks like there is some issue in mail server in sending logs. Changed the server configurations resolved the issue.

Thanks!

View solution in original post

0 Karma

bharathkumarnec
Communicator

Hi All,,

Issue got resolved, looks like there is some issue in mail server in sending logs. Changed the server configurations resolved the issue.

Thanks!

0 Karma

woodcock
Esteemed Legend

It is nice that you have your problem solved but you came to this forum looking for help and others will do the same. It will very much help them if you give us the full details about what you figured out was wrong and exactly what you did to fix it. Plus, I am quite curious.

0 Karma

bharathkumarnec
Communicator

HI woodcock,

The exact issue in my case is SMTP server, changing SMTP server address to new server this issue got resolved.
With old SMTP server mails are not flowing out and our messaging teams are trying to find out the root cause of this issue.

Thanks for your support & help!

0 Karma

bharathkumarnec
Communicator

Hi Mus,

Yeah I see below errors when I run the query:

(550, No Such domain at this location )

but we used to receive emails previously, for the same emails we are seeing above errors

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

The error message says "file too large", so I'd guess the file you attempted to mail was too large for your mail box.

0 Karma

bharathkumarnec
Communicator

Hi martin_mueller,

Thanks for the reply!

If that is the case, how can i check what is the alert that has high size?

and some alerts that doesnt have the attachment too are not receiving from splunk

0 Karma

MuS
SplunkTrust
SplunkTrust

check the triggered alerts view http://docs.splunk.com/Documentation/Splunk/6.3.0/Alert/Reviewtriggeredalerts to check the alerts and their size, you can also check index=_internal ( sourcetype=scheduler alert_actions="email" ) OR ( sourcetype=splunk_python "sendemail" ) to see if you get an error related to any alerts and emails

0 Karma
Get Updates on the Splunk Community!

Observability Highlights | January 2023 Newsletter

 January 2023New Product Releases Splunk Network Explorer for Infrastructure MonitoringSplunk unveils Network ...

Security Highlights | January 2023 Newsletter

January 2023 Splunk Security Essentials (SSE) 3.7.0 ReleaseThe free Splunk Security Essentials (SSE) 3.7.0 app ...

Platform Highlights | January 2023 Newsletter

 January 2023Peace on Earth and Peace of Mind With Business ResilienceAll organizations can start the new year ...