MonitorWare Knowledge Base

Hi everyone,

how to configure the syslog to send via smtp? i have already specify my smtp server,port, sender, recipient,
subject : Cisco 3600 (passive switch) Alert: %source%
mail message format :
Event message:
Facility: %syslogfacility%
Priority: %syslogpriority%
Source: %source%

Message:
%msg%

use authentication, where the account has already been setup on the mail server.

the syslog manage to log traffic from my routers and switches, but just can't send out, anything i missed?

Do you see any errors or warnings in the application event log (this is where we log problems)? Also, does another action in the same rule (e.g. write file) work?

Looking forward to your reply,
Rainer Gerhards
Adiscon

Hi Rainer,

thanks for your reply. yes write file works, i notice this event error on the server : event ID 114, 151

What other info do you need?

The 114 error unfortunately is a very generic one. I would appreciate if you could post the actual event message text, too.

Sorry for the inconvenience,
Rainer

there you go

Error while applying an action - skipping this action. Error is 'Error talking to smtp-server - END OF MAIL'.

thanks much!

Hi,

the error at this position is very odd.
It happens at the very end of the Emailsending. Unfortunately, the debug informations do not show the error source at the moment.

Is it possible for you to check the logfile of the mailserver for the error reason? This would be great.

best regards,
Andre Lorbach

i get my mail administrator to go through the mail log a number of times, but he sees no error. can you confirm that a request has reached the mail server so that we can go through the log one more time.

Yes I can confirm that the request has reached the mailserver. To go further, SMTP talk has taken place. Also smtp authentification may was successfull. However at the end, an protocoll error is received.

Very odd, and to find out more we would have to add soem more debug output in this region. Maybe you can ask the mail administrator how the server handels invalid logins? Maybe the Server does not respond with the usual SMTP Error code.

the mail server is not doing authentication, but the problem is that I have too many DCs across the world, so authentication can be done everywhere....hard to bug those folks, some error code coming up:

Error while applying an action - skipping this action. Error is 'Internal TCP Error in Send(): 10053'.

Error while applying an action - skipping this action. Error is 'Error talking to smtp-server (Response Status 500) - EHLO FAILED'.

Error while applying an action - skipping this action. Error is 'Error talking to smtp-server (Response Status 421) - EHLO FAILED'.

i hope it helps ?

I am not sure, are these error's from the same machine?

TCP Error 10053 means WSAECONNABORTED, so the connection was aborted by the remote site.

The other two error's are protocol error's. Without further details on your configuration, it is hard to tell what causes the error. Please export your configuration as regfile and send it to support@adiscon.com for further analysis.

best regards,
Andre Lorbach

how to export it in registry format?

thanks,

Sorry I forgot to mention
Use the WinSyslogClient Computer Menu to export the registry settings.

best regards,
Andre Lorbach

sorry guy,

i don't see an option to attached the registry output, do you have an email address that i can send to?

Hi,

you can export the registry settings into a file which you can then send us by email to support@adiscon.com.

best regards,
Andre Lorbach

Hi,

any news? i have already sent the registry file to you. Have you received it?

regards,
paul