MonitorWare Knowledge Base

Hi,

I dont seem to be able to get ommail mail alerts to work properly with more than one "if" statement in my rsyslog conf file.

The relavant section of my conf file is shown here:

$ActionMailSMTPServer smtp.domain.net
$ActionMailFrom syslog@domain.net
$ActionMailTo alerts@domain.net
$template mailSubject,"Network Alert! on %hostname%"
$template mailBody,"RSYSLOG Alert\r\nmsg='%msg%'"
$ActionMailSubject mailSubject
# the if ... then ... mailBody mus be on one line!
if $msg contains 'STORM_CONTROL-2-SHUTDOWN' then :ommail:;mailBody
if $msg contains 'DUAL-5-NBRCHANGE' then :ommail:;mailBody

When I initially tested this with just one "if $msg contains" line it worked fine, but with two it doesnt seem to be working anymore. I cant see any examples on the web or this forum of this type of config so Im a bit stumped. Can anyone help?

thanks, Andy Smith.

• Custom written rsyslog.conf?
• Maintenance Contract?
• Installation support?

Please see the ommail doc:

http://www.rsyslog.com/doc-ommail.html

The to recipient is re-set after each action. So you must specify it in front of both the actions. That should do the trick.

Please let us know if that works for you.

Rainer

Hi,

thanks for the tip. Actually I found my problem had a more fundamental root in the end. Even though the rsyslogd is running on the same server as the smtp server mail from rsyslogd was being rejected because relay was denied. This was because instead of showing the sender as the loopback, rsyslog mails are shown as coming from the public IP of the mail server. A little odd, but once Id added this IP as an allowed relay the mails worked fine (+ using the syntax as you suggested).

One other odd thing to throw in in (possibly for your interest ) is that the mails sent from rsyslog when delivered to my mail account are showing with a recieved/delivery date of 1/1/1970, Ive never seen this before so am inclined to think its in some way due to rsyslogd. Im using and Exim4 mail server with a horde IMAP webmail client,

thanks for your help,

Andy.

Can you please post a copy of the mail headers. Something environment-specifc may go wrong. I do NOT need mail content, just the headers...

Here is the header:

Return-path: <syslog@ukgrid.net>
Envelope-to: a.smith@ukgrid.net
Delivery-date: Fri, 21 Nov 2008 11:22:32 +0000
Received: from mailnull by mx1.ukgrid.net with spam-scanned (Exim 4.69; FreeBSD)
envelope-from syslog@ukgrid.net
envelope-to a.smith@ukgrid.net
id 1L3U5m-0005Uy-85; Fri, 21 Nov 2008 11:22:32 +0000
X-Spam-Checker-Version: SpamAssassin 3.2.5 (2008-06-10) on anita.ukgrid.net
X-Spam-Level:
X-Spam-Status: No, score=0.1 required=5.0 tests=MISSING_MID,RDNS_NONE
autolearn=no version=3.2.5
Received: from [89.107.16.164] (port=62852 helo=anita)
by mx1.ukgrid.net with smtp (Exim 4.69; FreeBSD)
envelope-from syslog@ukgrid.net
envelope-to a.smith@ukgrid.net
id 1L3U5m-0005Uu-7a; Fri, 21 Nov 2008 11:22:30 +0000
Date: Fri, 21 Nov 2008 11:22:30 UT
From: <syslog@ukgrid.net>
To: <a.smith@ukgrid.net>
Subject: Network Alert! on core.hex.lon.ip.ukgrid.net
X-Mailer: rsyslog-immail
Message-Id: <E1L3U5m-0005Uy-85@mx1.ukgrid.net>



thanks, Andy.

Thanks. I see the date header, but it looks like something is wrong with it. I'll investigate...