pandora don't send mail when alert is fired [FIXED]

[rompetechos]

Hi,

I just installed Pandora FMS 3.2.1 on Debian and at the time everithing work properly, until i tried to configure one email alert.

In the mta (Postfix) i saw this:

Jun  7 11:19:02 monitor01 postfix/smtpd[5438]: connect from localhost[127.0.0.1]
Jun  7 11:19:02 monitor01 postfix/smtpd[5438]: lost connection after EHLO from localhost[127.0.0.1]
Jun  7 11:19:02 monitor01 postfix/smtpd[5438]: disconnect from localhost[127.0.0.1]
Jun  7 11:19:17 monitor01 postfix/smtpd[5438]: connect from localhost[127.0.0.1]
Jun  7 11:19:17 monitor01 postfix/smtpd[5438]: lost connection after EHLO from localhost[127.0.0.1]

and in the pandora's server log, this:

2011-06-07 11:19:02 Monitor_red [V1] [ERROR] Sending email to yo@midominio.com with subject [PANDORA] Alert from agent 192.168.xxx.xxx on module
2011-06-07 11:19:17 Monitor_red [V1] [ERROR] Sending email to yo@imidominio.com with subject [PANDORA] Alert from agent SW-Mesa-P1-Com on module FastEthernet3_Uplink
2011-06-07 11:19:17 Monitor_red [V1] [ERROR] Sending email to tu@midominio.com with subject [PANDORA] Alert from agent SW-Mesa-P1-Com on module FastEthernet3_Uplink
2011-06-07 11:20:22 Monitor_red [V1] [ERROR] Sending email to yo@midominio.com with subject [PANDORA] Alert RECOVERED for CRITICAL status on SW-Mesa-P1-Com / FastEthernet3_Uplink

the mta has work well with other service/servers and i can successfully launch

echo "test" | mail -s "test subject" yo@midominio.com

finally i try to send mail with the rely open and no authentication for the Pandoras's server ip whith the same result.

thanks in advanced and sorry for my poor english level.

[tpalacios]

Greetings Rompetechos,

Please check this thread in the forum regarding another user who had the same problem.

Follow the link in there to learn about defining mail alerts in Pandora.

Pandora Mail Settings

I hope this solves your problem... otherwise you can send us additional info about it.

Regards.

[rompetechos]

Hi,
Thank you for the answer!

unfortunately after check the link the problem persist, what kind of information do you need?

At the moment, the situation is as follows:

• Send mail from the shell in the Pandora's Server => Ok
• Other aplication using the same mta => Ok

I checked the alert is fired, and Pandora tried to send the mail, but in the mail.log file appear

Jun  7 11:19:02 monitor01 postfix/smtpd[5438]: connect from localhost[127.0.0.1]
Jun  7 11:19:02 monitor01 postfix/smtpd[5438]: lost connection after EHLO from localhost[127.0.0.1]
Jun  7 11:19:02 monitor01 postfix/smtpd[5438]: disconnect from localhost[127.0.0.1]

The mta is a postfix server from a Debian stable distro.

Thanks in advanced

[tpalacios]

Hi again :)

We'll try to reproduce and fix your problem in a test environment with similar conditions.

Meanwhile, please activate verbosity 10 by editing your pandora_server.conf file, restart it, and show us any new information regarding this subject.

Check your pandora_server.log and pandora_server.error in /var/log as well.

Feel free to add a detailed description about how you configured your alert, attaching screenshots of this process, removing any kind of sensitive info that you don't want to be shown. This way you will help us to diagnose this problem better and faster!

Regards.

[rompetechos]

Thanks,

Here it's the output of pandora_server.log

2011-06-07 16:14:15 Monitor_red [V10] Processing module 'SW_Cisco_FastEthernet03_oct_IN' for agent ID 3.
2011-06-07 16:14:15 Monitor_red [V10] Processing module 'SW_Cisco_FastEthernet06_oct_IN' for agent ID 3.
2011-06-07 16:14:20 Monitor_red [V10] Reading trap '2011-06-7[**]16:14:19[**]192.168.xxx.xxx[**].1.3.6.1.4.1.9.1.897[**]2[**]Link Down[**]0[**].1.3.6.1.2.1.2.2.1.1.10003 = INTEGER: 10003   .1.3.6.1.2.1.2.2.1.2.10003 = STRING: "FastEthernet3"    .1.3.6.1.2.1.2.2.1.3.10003 = INTEGER: 6 .1.3.6.1.4.1.9.2.2.1.1.20.10003 = STRING: "down"'
2011-06-07 16:14:20 Monitor_red [V4] Received SNMP Trap from 192.168.xxx.xxx
2011-06-07 16:14:20 Monitor_red [V10] Evaluating SNMP alert ID 3.
2011-06-07 16:14:20 Monitor_red [V10] Executing action 'eMail' for alert '' agent '192.168.xxx.xxx'.
2011-06-07 16:14:20 Monitor_red [V1] [ERROR] Sending email to yo@midominio.com with subject [PANDORA] Alert from agent 192.168.xxx.xxx on module
2011-06-07 16:14:20 Monitor_red [V10] Generating event 'SNMP alert fired (Fast ehernet3 Down)' for agent ID 0 module ID 0.
2011-06-07 16:14:20 Monitor_red [V10] Reading trap '2011-06-7[**]16:14:20[**]192.168.xxx.xxx[**].1.3.6.1.4.1.9.9.41.2[**]6[**]Enterprise Specific[**].1[**].1.3.6.1.4.1.9.9.41.1.2.3.1.2.304 = STRING: "LINK"        .1.3.6.1.4.1.9.9.41.1.2.3.1.3.304 = INTEGER: 4  .1.3.6.1.4.1.9.9.41.1.2.3.1.4.304 = STRING: "UPDOWN"    .1.3.6.1.4.1.9.9.41.1.2.3.1.5.304 = STRING: "Interface FastEthernet3, changed state to down"    .1.3.6.1.4.1.9.9.41.1.2.3.1.6.304 = Timeticks: (2092726134) 242 days, 5:07:41.34'
2011-06-07 16:14:20 Monitor_red [V4] Received SNMP Trap from 192.168.xxx.xxx
2011-06-07 16:14:20 Monitor_red [V10] Evaluating SNMP alert ID 3.
2011-06-07 16:14:35 Monitor_red [V10] Reading trap '2011-06-7[**]16:14:35[**]192.168.xxx.xxx[**].1.3.6.1.4.1.9.9.41.2[**]6[**]Enterprise Specific[**].1[**].1.3.6.1.4.1.9.9.41.1.2.3.1.2.305 = STRING: "LINK"        .1.3.6.1.4.1.9.9.41.1.2.3.1.3.305 = INTEGER: 4  .1.3.6.1.4.1.9.9.41.1.2.3.1.4.305 = STRING: "UPDOWN"    .1.3.6.1.4.1.9.9.41.1.2.3.1.5.305 = STRING: "Interface FastEthernet3, changed state to up"      .1.3.6.1.4.1.9.9.41.1.2.3.1.6.305 = Timeticks: (2092727605) 242 days, 5:07:56.05'
2011-06-07 16:14:35 Monitor_red [V4] Received SNMP Trap from 192.168.xxx.xxx
2011-06-07 16:14:35 Monitor_red [V10] Evaluating SNMP alert ID 3.
2011-06-07 16:14:40 Monitor_red [V10] Reading trap '2011-06-7[**]16:14:36[**]192.168.xxx.xxx[**].1.3.6.1.4.1.9.1.897[**]3[**]Link Up[**]0[**].1.3.6.1.2.1.2.2.1.1.10003 = INTEGER: 10003     .1.3.6.1.2.1.2.2.1.2.10003 = STRING: "FastEthernet3"    .1.3.6.1.2.1.2.2.1.3.10003 = INTEGER: 6 .1.3.6.1.4.1.9.2.2.1.1.20.10003 = STRING: "up"'
2011-06-07 16:14:40 Monitor_red [V4] Received SNMP Trap from 192.168.xxx.xxx
2011-06-07 16:14:40 Monitor_red [V10] Evaluating SNMP alert ID 3.

content of pandora_server.error

2011-06-07 16:14:04 - Monitor_red Starting Pandora FMS Server. Error logging activated.
Use of uninitialized value in subroutine entry at /usr/lib/perl5/PandoraFMS/Core.pm line 1488, <SNMPLOGFILE> line 3.
Use of uninitialized value in subroutine entry at /usr/lib/perl5/PandoraFMS/Core.pm line 1488, <SNMPLOGFILE> line 3.

For the configuration of the alert i use the "Critical condition" default template (with my email in the default email action) and add an alert fire on critical event.

The device monitored is a cisco switch interface.

Thank you very much for the help.

[tpalacios]

I don't think the last alerts are affecting your mta...

Since your postfix works via shell in your Pandora Server... try commenting all the mta lines in pandora_server.conf except this one:

Code:

mta_from sender@mailaddress.com

You can choose any sender address, but the default one (pandora@localhost) because there might be additional problems.

I hope this helps you. :)

Regards.

[rompetechos]

It works fine !!


Thank you so much