Alerting

Why are we getting "error writing message: file too large", causing email alerts to not get sent out to users?

bharathkumarnec
Communicator

Hi All,

Today my users are claiming that they are not receiving email alerts from Splunk. Below are the steps taken to verify the same:

1) Verified in triggered alerts -- I see a count in triggered alerts
2) Verified python.log -- didn't find any errors, but I see events that say email sent to so and so address.

When I check the Linux email log \var\log\maillog, I found this error message:

postfix/local[number]: number:to =<xyz.localdomain>,orig_to=<splunk>, relay=local,delay=0.1,dsn=X.Y.Z,status=bounced (cannot update mailbox /var/mai/splunk for splunk. error writing message: file too large)

Is this related to size of the email?
Is this problem with SMTP?
I see CHMOD errors in \var\mail\splunk....

Any one faced this kind of situation, help in this regard is highly helpful.

Thanks in advance!

0 Karma
1 Solution

bharathkumarnec
Communicator

Hi All,,

Issue got resolved, looks like there is some issue in mail server in sending logs. Changed the server configurations resolved the issue.

Thanks!

View solution in original post

0 Karma

bharathkumarnec
Communicator

Hi All,,

Issue got resolved, looks like there is some issue in mail server in sending logs. Changed the server configurations resolved the issue.

Thanks!

0 Karma

woodcock
Esteemed Legend

It is nice that you have your problem solved but you came to this forum looking for help and others will do the same. It will very much help them if you give us the full details about what you figured out was wrong and exactly what you did to fix it. Plus, I am quite curious.

0 Karma

bharathkumarnec
Communicator

HI woodcock,

The exact issue in my case is SMTP server, changing SMTP server address to new server this issue got resolved.
With old SMTP server mails are not flowing out and our messaging teams are trying to find out the root cause of this issue.

Thanks for your support & help!

0 Karma

bharathkumarnec
Communicator

Hi Mus,

Yeah I see below errors when I run the query:

(550, No Such domain at this location )

but we used to receive emails previously, for the same emails we are seeing above errors

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

The error message says "file too large", so I'd guess the file you attempted to mail was too large for your mail box.

0 Karma

bharathkumarnec
Communicator

Hi martin_mueller,

Thanks for the reply!

If that is the case, how can i check what is the alert that has high size?

and some alerts that doesnt have the attachment too are not receiving from splunk

0 Karma

MuS
SplunkTrust
SplunkTrust

check the triggered alerts view http://docs.splunk.com/Documentation/Splunk/6.3.0/Alert/Reviewtriggeredalerts to check the alerts and their size, you can also check index=_internal ( sourcetype=scheduler alert_actions="email" ) OR ( sourcetype=splunk_python "sendemail" ) to see if you get an error related to any alerts and emails

0 Karma
Get Updates on the Splunk Community!

The Splunk Success Framework: Your Guide to Successful Splunk Implementations

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...