troubleshooting mailclient

[jibanes]

TA-mailclient should output to splunkd.log the result of POP/IMAP connections, in order to troubleshoot errors; or simply alert a user if his password is no longer valid or simply if mailclient wasn't able to retrieve emails.

[jibanes]

10-18-2016 16:30:22.547 +0000 WARN HttpListener - Socket error from 127.0.0.1 while accessing /servicesNS/nobody/search/data/inputs/mail/xxx%40gmail.com/: Broken pipe

[jibanes]

10-03-2016 16:05:02.937 +0000 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/TA-mailclient/bin/mail.py" ERRORlocal variable 'e' referenced before assignment

[jibanes]

I'm running Splunk 6.5.0 now btw.

[seunomosowon]

Yeah. One minute. my error.Will re-load in 5

[jibanes]

thanks, let me know.

[seunomosowon]

Fixed and tested. Uploaded 0.4.8

[jibanes]

This error doesn't show up anymore, but index=mail is still empty, and while mail.py is scheduled to run, it doesn't seem to error (it just INFO when it starts); would you have the magic string to run it from command line perhaps?

tcpdump on the imap port shows that the communication is established (in my case with imap.google.com) but ends up after a few seconds; it's SSL so I can't easily know what went through in the exchange itself.

[jibanes]

sorry I meant imap.gmail.com

[seunomosowon]

I just tried it on mine for POP3 and IMAP, and it works alright. What interval do you have the input setup to poll the server?

[jibanes]

I just moved it to every 15 minutes for troubleshooting; but there's not much to troubleshoot.

[seunomosowon]

Nothing shows when you do this?
index=_internal sourcetype=splunkd component=ExecProcessor mail.py log_level=INFO?

I'll try this using this for a gmail account tonight. And let you know if i find any issues using gmail.

[jibanes]

10-03-2016 18:45:00.908 +0000 INFO ExecProcessor - New scheduled exec process:
python /opt/splunk/etc/apps/TA-mailclient/bin/mail.py
10-03-2016 18:45:00.302 +0000 INFO ExecProcessor - message from "python /opt/sp
lunk/etc/apps/TA-mailclient/bin/mail.py" Password entity created - mail\xxx@
gmail.com.
10-03-2016 18:45:00.002 +0000 INFO ExecProcessor - setting reschedule_ms=899998
, for command=python /opt/splunk/etc/apps/TA-mailclient/bin/mail.py
10-03-2016 18:43:57.488 +0000 INFO ExecProcessor - New scheduled exec process:
python /opt/splunk/etc/apps/TA-mailclient/bin/mail.py
10-03-2016 18:41:09.671 +0000 INFO ExecProcessor - New scheduled exec process:
python /opt/splunk/etc/apps/TA-mailclient/bin/mail.py

[seunomosowon]

You could try setting the ExecProcessor to Debug, and see what you find int he logs.

/opt/splunk/bin/splunk set log-level ExecProcessor -level DEBUG

[jibanes]

Last run ( I removed my email address with xxx 😞

query: index=_internal sourcetype=splunkd component=ExecProcessor mail.py

results:

10-03-2016 18:30:00.346 +0000 INFO ExecProcessor - message from "python /opt/sp
lunk/etc/apps/TA-mailclient/bin/mail.py" Got credentials from endpoint - Usernam
e(xxx@gmail.com)
10-03-2016 18:30:00.002 +0000 INFO ExecProcessor - setting reschedule_ms=899998
, for command=python /opt/splunk/etc/apps/TA-mailclient/bin/mail.py

[jibanes]

I've deleted the input, recreated it, and the relevant query now displays:
(notice that my email address is prepended with \ not = as it was before?)

10-03-2016 18:45:00.908 +0000 INFO ExecProcessor - New scheduled exec process: python /opt/splunk/etc/apps/TA-mailclient/bin/mail.py
10-03-2016 18:45:00.302 +0000 INFO ExecProcessor - message from "python /opt/splunk/etc/apps/TA-mailclient/bin/mail.py" Password entity created - mail\xxx@gmail.com.
10-03-2016 18:45:00.002 +0000 INFO ExecProcessor - setting reschedule_ms=899998, for command=python /opt/splunk/etc/apps/TA-mailclient/bin/mail.py
10-03-2016 18:43:57.488 +0000 INFO ExecProcessor - New scheduled exec process: python /opt/splunk/etc/apps/TA-mailclient/bin/mail.py
10-03-2016 18:41:09.671 +0000 INFO ExecProcessor - New scheduled exec process: python /opt/splunk/etc/apps/TA-mailclient/bin/mail.py

[seunomosowon]

Yes, I'm currently testing, and should put this up today or tomorrow.

Thanks again.

[jibanes]

Thanks will test

[seunomosowon]

Do let me know how you get along with the update.

[jibanes]

09-20-2016 15:45:00.279 +0000 INFO ExecProcessor - message from "python /opt/splunk/etc/apps/TA-mailclient/bin/mail.py" Got credentials from endpoint - Username(xxx@gmail.com)

This unfortunately, is the only message I get from TA-mailclient, I don't see any mail going in the index, nor I know what made it fail to do so.

[seunomosowon]

Hi Jibanes,

I'll add this in over the next week and test, and I'll release an update. It'll log as INFO. Should also include support for more special characters in the password field.

Cheers

[jibanes]

did you have a chance to look into this?