Why are we getting "error writing message: file too large", causing email alerts to not get sent out to users?

[bharathkumarnec]

Hi All,

Today my users are claiming that they are not receiving email alerts from Splunk. Below are the steps taken to verify the same:

1) Verified in triggered alerts -- I see a count in triggered alerts
2) Verified python.log -- didn't find any errors, but I see events that say email sent to so and so address.

When I check the Linux email log \var\log\maillog, I found this error message:

postfix/local[number]: number:to =<xyz.localdomain>,orig_to=<splunk>, relay=local,delay=0.1,dsn=X.Y.Z,status=bounced (cannot update mailbox /var/mai/splunk for splunk. error writing message: file too large)

Is this related to size of the email?
Is this problem with SMTP?
I see CHMOD errors in \var\mail\splunk....

Any one faced this kind of situation, help in this regard is highly helpful.

Thanks in advance!

[bharathkumarnec · Accepted solution]

Hi All,,

Issue got resolved, looks like there is some issue in mail server in sending logs. Changed the server configurations resolved the issue.

Thanks!

[woodcock]

It is nice that you have your problem solved but you came to this forum looking for help and others will do the same. It will very much help them if you give us the full details about what you figured out was wrong and exactly what you did to fix it. Plus, I am quite curious.

[bharathkumarnec]

HI woodcock,

The exact issue in my case is SMTP server, changing SMTP server address to new server this issue got resolved.
With old SMTP server mails are not flowing out and our messaging teams are trying to find out the root cause of this issue.

Thanks for your support & help!

[bharathkumarnec]

Hi Mus,

Yeah I see below errors when I run the query:

(550, No Such domain at this location )

but we used to receive emails previously, for the same emails we are seeing above errors

[martin_mueller]

The error message says "file too large", so I'd guess the file you attempted to mail was too large for your mail box.

[bharathkumarnec]

Hi martin_mueller,

Thanks for the reply!

If that is the case, how can i check what is the alert that has high size?

and some alerts that doesnt have the attachment too are not receiving from splunk

[MuS]

check the triggered alerts view http://docs.splunk.com/Documentation/Splunk/6.3.0/Alert/Reviewtriggeredalerts to check the alerts and their size, you can also check index=_internal ( sourcetype=scheduler alert_actions="email" ) OR ( sourcetype=splunk_python "sendemail" ) to see if you get an error related to any alerts and emails