thanks for your quick answer, there is only one mail as recipient for this alarm. Is there any way to debug sending mail for each alert or any logfiles which shows, how many mails and when the mails were sent ? Where are the path of alert and condition on server ?
If you can’t find a notice about the mail you could raise the logging in Graylog to info or similar. The other option would be - check the logfile of your mailserver.
i couldn’t find any related logs in debug mode and on /var/log/graylog/server.log. The Logs of Mailserver shows that each time was 3x mails sent.
Could you please review my backlog config again and check if it’s 100% ok and give some idee to find the issue ? As i mentioned the issue is since i’m using backlog.
exception (Field Content Alert Condition)
Alerting on stream All messages
Message Backlog : 1
outofmemory (Field Content Alert Condition)
Alerting on stream All messages
Message Backlog : 1
Error (Field Content Alert Condition)
Alerting on stream All messages
Message Backlog : 1
and 3 Notifications with same names “exception, outofmemory, Error” .
i assume that there is copies of (multiple) condition which is not shown on graylog GUI but it exist on server. Where can i find this conditions / Notifications on server ?
What’s the next step to find the issue ?
We’re going to use graylog on more 200x servers and it’s very important for us to solve the issue.