Configuring email alerts

[Aldriza Fariq Muhammad]

Dear Wazuh Team,

we already Configuring email alerts, based on https://documentation.wazuh.com/current/user-manual/manager/manual-email-report/index.html. And we already succeed in sending a testing email using this command: echo "Test mail from postfix" | mail -s "Test Postfix" -r "aldriz...@gmail.com" aldriz...@gmail.com

But the email we still didn't receive the alarm yet even though we already set the email alert level set to level 2. Your help to resolve this issue will be appreciated, thank you

[elw...@wazuh.com]

Hello Aldriza,

Have you configured the following options:

<global>
     <email_notification>yes</email_notification>
     <email_to>m...@test.com</email_to>
     <smtp_server>localhost</smtp_server>
     <email_from>wa...@test.com</email_from>
</global>

If not, please proceed with it and then restart the Wazuh manager.

If the emails are still not being sent, please share the logs files /var/ossec/logs/ossec.log and /var/log/mail, as well as the configuration file /var/ossec/etc/ossec.conf.

Regards,
Wali

[Aldriza Fariq Muhammad]

Hi Elwali

Thanks for your response, now we still have not received the email.

attached are the logs files and configuration for  /var/ossec/logs/ossec.log and  /var/ossec/etc/ossec.conf.

For  /var/log/mail we didn't have the files yet, how to get those files?

Thank you so much for your help, really appreciate 

[Aldriza Fariq Muhammad]

Dear Wazuh team

Attached are the /var/log/mail.log files

Regards,

[elw...@wazuh.com]

Hello,

Thanks for the provided information.

It seems that you are specifying the google SMTP in Wazuh configuration  <smtp_server>smtp.google.com</smtp_server> but Wazuh does not handle the authentication to the SMTP's and it is the reason of using POSTFIX which you have already configured.

Having said that, you should use ` <smtp_server>localhost</smtp_server> and then restart the Wazuh manager(assuming that you have installed postfix in the same box as the Wazuh manager).


Hope this helps.

Regards,
Wali

[Aldriza Fariq Muhammad]

Dear Wazuh Team

Thanks, the problem is solved.