Graylog email issue

Have graylog configured to send mail, however when a ‘test’ notification is triggered, I get the following message in the dashboard:

The Graylog server encountered an error while trying to send an email. This is the detailed error message: java.lang.NullPointerException

There is no corresponding error in the graylog log file. The mail config is:

transport_email_enabled = true
transport_email_hostname = localhost
transport_email_port = 25
transport_email_protocol = smtp
transport_email_use_auth = false
transport_email_use_tls = false

any hints on what is wrong?

many thanks

Hello @darrinh

That error shown doesn’t real tell much, other then you have a issue.

Example of mine, which looks like yours.

transport_email_enabled = true
transport_email_hostname = localhost
transport_email_port = 25
transport_email_subject_prefix = [graylog]
transport_email_from_email =

Make sure your email software is working, send test mail.

To help further we would need more information. A better understanding on what is needed please take a look here.

Thanks GSmith, that error message in the OP is the only information it gives me. There is nothing appearing in /var/log/graylog-server/server.log about the mail. I can send mail from the cli with no issue.

Just realized there is a debug option for graylog, going to see if that provides more informatin.


With debugging enabled and sending a test notification I see:

2022-05-10T13:30:06.116+10:00 DEBUG [EmailSender] Sending mail to
2022-05-10T13:30:06.132+10:00 DEBUG [command] Sending command '{"find": "notifications", "filter": {"type": "email_transport_failed"}, "limit": 1, "singleBatch": true, "$db": "graylog"}' with request id 18057 to database graylog on connection [connectionId{localValue:3, serverValue:15}] to server localhost:27017

Not sure what it means.

Description of your problem

Graylog is unable to send email notifications. It simple says on the console:

Error: Notification has email recipients and is triggered, but sending emails failed. null

when the ‘test notification’ button is pressed. Additionally in the system → overview page it shows a similar notice:

 An error occurred while trying to send an email! (triggered a few seconds ago)
The Graylog server encountered an error while trying to send an email. This is the detailed error message: java.lang.NullPointerException

Description of steps you’ve taken to attempt to solve the issue

Have successfully been able to send mail from the host via the cli. Have tried
altering the graylog smtp config options

Environmental information

Operating system information

  • Ubuntu 20.04

Package versions

  • Graylog 4.2.8-1
  • MongoDB 4.4.13
  • Elasticsearch 7.10

Service logs, configuration, and environment variables

There is no additional information present in the graylog-server log file about the mail issue.

Thanks for the added details. How did you configure you notification template?

Hi, I’ve just used the default template, the only change is adding to the ‘User recipient(s)’ field. I’ve tried different emails in there with no result. I’ve tried altering the mail conf section:

# Email transport
transport_email_enabled = true
transport_email_hostname = localhost
transport_email_port = 25
#transport_email_protocol = smtp
#transport_email_use_auth = false
#transport_email_auth_username =
#transport_email_auth_password = secret
transport_email_subject_prefix = [graylog]
#transport_email_from_email =

# Encryption settings
#    Using SMTP with STARTTLS *and* SMTPS at the same time is *not* possible.

# Use SMTP with STARTTLS, see
transport_email_use_tls = false

# Use SMTP over SSL (SMTPS), see
# This is deprecated on most SMTP services!
transport_email_use_ssl = false

Graylog appears to be working now for sending mail, not 100% sure why. I did re-updated the mail config and found that notifications themselves seemed to have wanted a sender set, even though the field is marked optional.



Since there is no information in Graylog’s log file have you check you mailog?

[root@graylog log]# pwd
[root@graylog log]# ls -al maillog
-rw-r--r--. 1 root root 86K May 10 16:30 maillog
[root@graylog log]#

Perhaps there might be something in there that can identify the problem.
Should look something like this.

May 10 14:28:23 graylog sendmail[115407]: 24AJSM86115405: to=<>, delay=00:00:01, xdelay=00:00:01, mailer=esmtp, pri=131918, [], dsn=2.0.0, stat=Sent (<> [InternalId=13426067777516,] 20875 bytes in 0.365, 55.730 KB/sec Queued mail for delivery)

Are you using sendmail or postfix? I’m assuming the mail software is set with default configurations?
Ensure Selinux/Apparmor, Firewall is not blocking port 25

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.