Graylog 4.1.2 - Email Alert on Docker

Graylog Central (peer support)
1

Hello There,

I’m trying to configure email alerts on graylog (using docker to run it, mongo and elastic, working fine for logs), but for mails it is not working and I’m not sure why, my email server is on another server.

Config:

 graylog:
      image: graylog/graylog:4.1.2
      environment:
        - GRAYLOG_ROOT_TIMEZONE=Etc/GMT+3
        - GRAYLOG_PASSWORD_SECRET=blablabla
        - GRAYLOG_ROOT_PASSWORD_SHA2=blablabla
        - GRAYLOG_WEB_ENDPOINT_URI=http://10.10.0.5:9000/api

        - GRAYLOG_TRANSPORT_EMAIL_ENABLED=true
        - GRAYLOG_TRANSPORT_EMAIL_PROTOCOL=smtp
        - GRAYLOG_TRANSPORT_EMAIL_HOSTNAME=10.0.0.189
        - GRAYLOG_TRANSPORT_EMAIL_PORT=587
        - GRAYLOG_TRANSPORT_EMAIL_USE_AUTH=true
        - GRAYLOG_TRANSPORT_EMAIL_AUTH_USERNAME=user@mydomain.com
        - GRAYLOG_TRANSPORT_EMAIL_AUTH_PASSWORD=useremailpassword
        - GRAYLOG_TRANSPORT_EMAIL_USE_TLS=true
        - GRAYLOG_TRANSPORT_EMAIL_USE_SSL=false
        - GRAYLOG_TRANSPORT_EMAIL_FROM_EMAIL=user@mydomain.com
        - GRAYLOG_TRANSPORT_EMAIL_SUBJECT_PREFIX=[graylog]

      links:
       ................

If I connect on the graylog container (docker exec) and try to connect via openssl to the mail server (10.10.0.5) and send an email manually it works just fine.

[root@ip-10-10-0-5:/docker]: openssl s_client -starttls smtp -connect 10.0.0.189:587
CONNECTED(00000003)
...........
verify error:num=18:self signed certificate
verify return:1
...........
---
250 CHUNKING
EHLO mydomain.com
250-mailing.mydomain.com
250-PIPELINING
250-SIZE 10240000
250-VRFY
250-ETRN
250-AUTH PLAIN LOGIN
250-AUTH=PLAIN LOGIN
250-ENHANCEDSTATUSCODES
250-8BITMIME
250-DSN
250 CHUNKING
AUTH PLAIN AHBvcnRhbDE1OTczAFdjSjhIbUxGWWExRXRVSTVBcz
235 2.7.0 Authentication successful
MAIL FROM: user@mydomain.com
250 2.1.0 Ok
rcpt to: user@othereemail.com
250 2.1.5 Ok
DATA
354 End data with <CR><LF>.<CR><LF>
Hello from manual mail inside the container
.
250 2.0.0 Ok: queued as 2F1BBCA750
quit
221 2.0.0 Bye
closed

Don’t know what else can I try, or how to debug this.

Thanks for any help.

2

When you say that email isn’t working, what do you mean? Given your container configuration, you’ve got the attributes configured for email, but it’s not clear that the email functionality itself isn’t working, or that you even have the plugin installed for email to work. Can you post your complete (redacted) compose file?

Also, it looks like you might be using some deprecated config options. See Upgrading to Graylog 3.0.x — Graylog 4.1.0 documentation

3

Sorry, forgot to put in the error (get this while trying to test notification on the alert config):

Error: Notification has email recipients and is triggered, but sending emails failed. Sending the email to the following server failed : 10.0.0.189:587

Plugin? Didn’t see any info about needing a plugin on the docs for basic alerts. Alerts — Graylog 4.1.0 documentation

Is there a problem on “forcing” the defaults of those “deprecated” settings?

        - GRAYLOG_TRANSPORT_EMAIL_USE_TLS=true
        - GRAYLOG_TRANSPORT_EMAIL_USE_SSL=false

The rest of the compose is graylog, mongo and elastic config, and graylog is working on getting my logs, just this email feature that is not.

The connection to the email server from within the container is working, just when trying to use the graylog it is not.

Is there a way to debug this?

4

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.