SMTP Configuration problem

Graylog Central (peer support)
1

Hi there!

I’m trying to send email alert every time Graylog receive some [ERROR] message. However something wrong is with my configuration. Can anyone help to determine what’s wrong?

[root@bss-eagle graylog]# grep “^[^#;]” /srv/graylog/config/graylog.conf
is_master = true
node_id_file = /usr/share/graylog/data/config/node-id
password_secret = replacethiswithyourownsecret!
root_password_sha2 = 8c6976e5b5410415bde908bd4dee15dfb167a9c873fc4bb8a81f6f2ab448a918
root_email = "graylog@mydomain.com"
root_timezone = Europe/Warsaw
plugin_dir = /usr/share/graylog/plugin
rest_listen_uri = http://0.0.0.0:9000/api/
web_listen_uri = http://0.0.0.0:9000/
web_enable_cors = true
rotation_strategy = count
elasticsearch_max_docs_per_index = 20000000
elasticsearch_max_number_of_indices = 20
retention_strategy = delete
elasticsearch_shards = 4
elasticsearch_replicas = 0
elasticsearch_index_prefix = graylog
allow_leading_wildcard_searches = true
allow_highlighting = true
elasticsearch_cluster_name = graylog
elasticsearch_transport_tcp_port = 9350
elasticsearch_http_enabled = false
elasticsearch_discovery_zen_ping_multicast_enabled = false
elasticsearch_discovery_zen_ping_unicast_hosts = elasticsearch:9300
elasticsearch_network_host = 0.0.0.0
elasticsearch_analyzer = standard
output_batch_size = 500
output_flush_interval = 1
output_fault_count_threshold = 5
output_fault_penalty_seconds = 30
processbuffer_processors = 5
outputbuffer_processors = 3
processor_wait_strategy = blocking
ring_size = 65536
inputbuffer_ring_size = 65536
inputbuffer_processors = 2
inputbuffer_wait_strategy = blocking
message_journal_enabled = true
message_journal_dir = /usr/share/graylog/data/journal
lb_recognition_period_seconds = 3
mongodb_uri = mongodb://mongo/graylog
mongodb_max_connections = 100
mongodb_threads_allowed_to_block_multiplier = 5
transport_email_enabled = true
transport_email_protocol = smtp
transport_email_hostname = 10.4.2.99 # smtp server
transport_email_port = 465
transport_email_use_auth = true
transport_email_use_tls = true
transport_email_auth_username = graylog@mydomain.com
transport_email_auth_password = SeCrEtPaSsWd
transport_email_subject_prefix = [graylog2]
transport_email_from_email = graylog@mydomain.com
transport_email_from_name = Graylog2
transport_email_web_interface_url = http://[graylog-web-ui]:9000/
content_packs_loader_enabled = true
content_packs_dir = /usr/share/graylog/data/contentpacks
content_packs_auto_load = grok-patterns.json
rules_file = /srv/graylog/config/graylog.drl

When I’m trying to send test message I’ve got this error:
An error occurred while trying to send an email! (triggered 31 minutes ago)
The Graylog server encountered an error while trying to send an email. This is the detailed error message: org.apache.commons.mail.EmailException: Sending the email to the following server failed : 10.4.2.99:465 (com.sun.mail.util.MailConnectException: Couldn’t connect to host, port: 10.4.2.99, 465; timeout 60000; nested exception is: java.net.SocketTimeoutException: connect timed out)

2

Your configuration looks fine to me - but the selection of ports, use_auth and use_tls are things to tinker with.

Apologies if you have already been through all these items - we had some trouble with email initially and these were the things we did first.

Things to check:

  1. Can you telnet to your email server on port 465 from your graylog server? Can you ping it?
  2. You might try port 587 instead of 465 (this can be dependent on your email server’s configuration).
  3. Does this account work correctly outside Graylog? Are you able to configure an email client using the creds, port and ip listed?

Dustin

1 Like
3

Thank for your suggestion. I’ve got a problem with my email server conf. Indeed, graylog.conf was fine.

You can close this topic. Thanks!

4

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.