Why my sendemail.py for alerts gets killed?

[sylim_splunk]

I have several reports set up and configured to send email alerts. But I'm not getting emails which appears due to the below WARN messages. Mostly this happens to the reports running at night, like after 9pm..

05-22-2017 19:05:13.201 +0000 WARN script - Script has timed out and will be killed, maxtime=300sec, script=/opt/splunk/bin/python /opt/splunk/etc/apps/search/bin/sendemail.py '"results_link=https://splunk.mysplunk.com.au/app/search/@go?sid=scheduler__my user_searchRMDb6ea072df8e31633_at_1495479600_37189"' '"ssname=ErrorCode Testing"' '"graceful=True"' '"trigger_time=1495479612"' 'results_file="/opt/splunk/var/run/splunk/dispatch/schedulermyusersearch_RMDb6ea072df8e31633_at_1495479600_37189/results.csv.gz"'

This is my configuration, using amazon email service;
In etc/system/local/alert_actions.conf
mailserver = email-smtp.east.amazonaws.com:25
use_tls = 1

Why it takes more than 5 mins for the sendemail.py to send just short email message?

[sylim_splunk · Accepted solution]

This turns out to be caused by the amazon mailserver limiting max daily emails allowed.

https://stackoverflow.com/questions/34694978/why-does-amazon-ec2-limit-port-25/34695131
-- excerpts --
Amazon EC2 imposes default sending limits on email sent via port 25 and throttles outbound connections if you attempt to exceed those limits. To remove these limits, submit a Request to Remove Email Sending Limitations. You can also connect to Amazon SES via port 465 or port 587, neither of which is throttled.

After changing the port 25 to 587 it appears all good now.