Reporting

Why my sendemail.py for alerts gets killed?

sylim_splunk
Splunk Employee
Splunk Employee

I have several reports set up and configured to send email alerts. But I'm not getting emails which appears due to the below WARN messages. Mostly this happens to the reports running at night, like after 9pm..

05-22-2017 19:05:13.201 +0000 WARN script - Script has timed out and will be killed, maxtime=300sec, script=/opt/splunk/bin/python /opt/splunk/etc/apps/search/bin/sendemail.py '"results_link=https://splunk.mysplunk.com.au/app/search/@go?sid=scheduler__my user_searchRMDb6ea072df8e31633_at_1495479600_37189"' '"ssname=ErrorCode Testing"' '"graceful=True"' '"trigger_time=1495479612"' 'results_file="/opt/splunk/var/run/splunk/dispatch/schedulermyusersearch_RMDb6ea072df8e31633_at_1495479600_37189/results.csv.gz"'

This is my configuration, using amazon email service;
In etc/system/local/alert_actions.conf
mailserver = email-smtp.east.amazonaws.com:25
use_tls = 1

Why it takes more than 5 mins for the sendemail.py to send just short email message?

0 Karma
1 Solution

sylim_splunk
Splunk Employee
Splunk Employee

This turns out to be caused by the amazon mailserver limiting max daily emails allowed.

https://stackoverflow.com/questions/34694978/why-does-amazon-ec2-limit-port-25/34695131
-- excerpts --
Amazon EC2 imposes default sending limits on email sent via port 25 and throttles outbound connections if you attempt to exceed those limits. To remove these limits, submit a Request to Remove Email Sending Limitations. You can also connect to Amazon SES via port 465 or port 587, neither of which is throttled.

After changing the port 25 to 587 it appears all good now.

View solution in original post

0 Karma

sylim_splunk
Splunk Employee
Splunk Employee

This turns out to be caused by the amazon mailserver limiting max daily emails allowed.

https://stackoverflow.com/questions/34694978/why-does-amazon-ec2-limit-port-25/34695131
-- excerpts --
Amazon EC2 imposes default sending limits on email sent via port 25 and throttles outbound connections if you attempt to exceed those limits. To remove these limits, submit a Request to Remove Email Sending Limitations. You can also connect to Amazon SES via port 465 or port 587, neither of which is throttled.

After changing the port 25 to 587 it appears all good now.

0 Karma
Get Updates on the Splunk Community!

Introducing Ingest Actions: Filter, Mask, Route, Repeat

WATCH NOW Ingest Actions (IA) is the best new way to easily filter, mask and route your data in Splunk® ...

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...