ERROR:root:(552, '5.3.4 Message size exceeds fixed limit', u'xxxxxx') while sending mail to: xxxxxx

[sylim_splunk]

Our email alert stop sending ... came across ERROR in the splunkd logs

08-29-2019 15:53:04.600 -0400 ERROR ScriptRunner - stderr from '/opt/splunk/bin/python /opt/splunk/etc/apps/search/bin/sendemail.py "results_link=https://host.abcd.net/app/abcdefg/@go?sid=scheduler__username_aAAAAAAAAQ__RMD1234556ABCDEFG_at_15671..." "ssname=AAA "> 1"MyReport TEST" "graceful=True" "trigger_time=1567108376" results_file="/opt/splunk/var/run/splunk/dispatch/scheduler_username_aAAAAAAAAQ_RMD1234556ABCDEFG_at_1567108320_86782_0972A208-ABCD-4000-98B2-ABCD046F3B4A/results.csv.gz"': ERROR:root:(552, '5.3.4 Message size exceeds fixed limit', u'AAAAABBBBB@abcd.net') while sending mail to: abcd@abcd.net

[sylim_splunk · Accepted solution]

The error was generated by the receiving SMTP server complaining that the email hit the size limit on the server - it could have been set on server level or per user or team, role basis, or sender/receiver basis it could vary.
Please contact your mail system admin to discuss it. Before that you can go and check the size of attachment which can be found in the path below ;

results_file="/opt/splunk/var/run/splunk/dispatch/scheduler_username_aAAAAAAAAQ_RMD1234556ABCDEFG_at_1567108320_86782_0972A208-ABCD-4000-98B2-ABCD046F3B4A/results.csv.gz

Emails get encrypted which could increase the size by 30% or so.

Or you can try to reduce the size by changing the search commands or time-ranges.