Alerting

Why are we getting "error writing message: file too large", causing email alerts to not get sent out to users?

bharathkumarnec
Contributor

Hi All,

Today my users are claiming that they are not receiving email alerts from Splunk. Below are the steps taken to verify the same:

1) Verified in triggered alerts -- I see a count in triggered alerts
2) Verified python.log -- didn't find any errors, but I see events that say email sent to so and so address.

When I check the Linux email log \var\log\maillog, I found this error message:

postfix/local[number]: number:to =<xyz.localdomain>,orig_to=<splunk>, relay=local,delay=0.1,dsn=X.Y.Z,status=bounced (cannot update mailbox /var/mai/splunk for splunk. error writing message: file too large)

Is this related to size of the email?
Is this problem with SMTP?
I see CHMOD errors in \var\mail\splunk....

Any one faced this kind of situation, help in this regard is highly helpful.

Thanks in advance!

0 Karma
1 Solution

bharathkumarnec
Contributor

Hi All,,

Issue got resolved, looks like there is some issue in mail server in sending logs. Changed the server configurations resolved the issue.

Thanks!

View solution in original post

0 Karma

bharathkumarnec
Contributor

Hi All,,

Issue got resolved, looks like there is some issue in mail server in sending logs. Changed the server configurations resolved the issue.

Thanks!

0 Karma

woodcock
Esteemed Legend

It is nice that you have your problem solved but you came to this forum looking for help and others will do the same. It will very much help them if you give us the full details about what you figured out was wrong and exactly what you did to fix it. Plus, I am quite curious.

0 Karma

bharathkumarnec
Contributor

HI woodcock,

The exact issue in my case is SMTP server, changing SMTP server address to new server this issue got resolved.
With old SMTP server mails are not flowing out and our messaging teams are trying to find out the root cause of this issue.

Thanks for your support & help!

0 Karma

bharathkumarnec
Contributor

Hi Mus,

Yeah I see below errors when I run the query:

(550, No Such domain at this location )

but we used to receive emails previously, for the same emails we are seeing above errors

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

The error message says "file too large", so I'd guess the file you attempted to mail was too large for your mail box.

0 Karma

bharathkumarnec
Contributor

Hi martin_mueller,

Thanks for the reply!

If that is the case, how can i check what is the alert that has high size?

and some alerts that doesnt have the attachment too are not receiving from splunk

0 Karma

MuS
SplunkTrust
SplunkTrust

check the triggered alerts view http://docs.splunk.com/Documentation/Splunk/6.3.0/Alert/Reviewtriggeredalerts to check the alerts and their size, you can also check index=_internal ( sourcetype=scheduler alert_actions="email" ) OR ( sourcetype=splunk_python "sendemail" ) to see if you get an error related to any alerts and emails

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...