Alerting

Why is sendemail not using correct mailserver?

davidblader
New Member

Hello,

I've been trying to get my splunk instance to send out email alerts using Amazon SES SMTP server without much luck.

The error in my python.log file seems to suggest that it is not collecting the correct server I have configured under Settings -> Server settings -> Email settings - or alert_actions.conf

The error being:
ERROR sendemail:142 - Sending email. ... server="localhost"
ERROR sendemail:473 - [Errno 111] Connection refused while sending mail to: email@domain.com

oddly enough, it gathers email@domain.com just fine as defined in my alert definition.

I've seen other posts on here suggesting that values in savedsearches.conf can override the action.email.mailserver configuration, but I see no such file in my local config directory or any other suggestion of a conflict for action.email.mailserver

0 Karma

PavelP
Motivator

you can check with btool if some app override the setting by unsetting the value:

  /opt/splunk/bin/splunk btool savesearches list --debug|grep mailserver

  /opt/splunk/bin/splunk btool alert_actions list --debug|grep mailserver

savedsearches.conf:

action.email.mailserver = <string>
* Set the address of the MTA server to be used to send the emails.
* Defaults to <LOCALHOST>
    (or the 'mailserver' setting in alert_actions.conf file)

alert_actions.conf:

mailserver = <host>[:<port>]
* You must have a Simple Mail Transfer Protocol (SMTP) server available
  to send email. This is not included with Splunk.
* Specifies the SMTP mail server to use when sending emails.
* <host> can be either the hostname or the IP address.
* Optionally, specify the SMTP <port> that Splunk should connect to.
* When the 'use_ssl' setting (see below) is set to 1 (true), you
  must specify both <host> and <port>.
  (Example: "example.com:465")
* Default: $LOCALHOST:25
0 Karma

davidblader
New Member

Hey, thanks for the response!

running these both gave me

/opt/splunk/bin/splunkd: error while loading shared libraries: libjemalloc.so.2: cannot open shared object file: No such file or directory

EDIT: Disregard, misread the commands you provided. no results for the first command, the second command spits out the correct smtp server that I'm expecting. No overwrites.

0 Karma

PavelP
Motivator

does setting smtp server in savedsearches.conf helps?

0 Karma
Get Updates on the Splunk Community!

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...

Observability Highlights | January 2023 Newsletter

 January 2023New Product Releases Splunk Network Explorer for Infrastructure MonitoringSplunk unveils Network ...