Send mail error

[Harihara Purohita]

Hi Team,

I am getting the below error while trying to send test email from the wazuh dashboard,

Verified the ossse.cfg file configuration based on manual, still same error. But from the command line I am able to send mail using sendemail command.

TIA for your support and response.

Thanks,

Haris

[Isaiah Daboh]

Hi,

Please kindly reproduce and share the content of   /var/ossec/logs/ossec.log for further review of the error.

Regards,

[Harihara Purohita]

Hi Team,

Please find the ossec.log file for further review.

Thanks,

Haris

[Isaiah Daboh]

Hi, 

The logs have been reviewed with no error message.

Please confirm that in your ossec.conf, the smtp server is 'localhost' <smtp_server>localhost</smtp_server>, if not please change this to localhost.

Should the error persist, please do the following:

• Set the debug level to 2
  /var/ossec/etc/internal_options.conf
  analysisd.debug=2
  
  
• Restart the manager
• Resend the test mail to reproduce the error
• With that, look into the logs for possible related error / warning messages.
  
• Please share error or warning messages.
• If there is no error then please share any errors in the /var/log/maillog.
  

Regards,

[Harihara Purohita]

Hi Isaiah,

Thank you for your quick response.

As per the above suggestion,  we have changed  the smtp server to 'localhost' and restarted wazuh-manager.

Still we are getting the same error.

please find the /var/log/maillog logs.

Thanks,

Haris

[Isaiah Daboh]

Hi Haris,

From the maillog logs, it looks like there is an issue with the hostname resolution. 

Please can you edit  the /etc/hosts file as follows.

Change: 

127.0.0.1 localhost localhost.localdomain 

127.0.0.1 server_hostname

To:

127.0.0.1 localhost localhost.localdomain server_hostname

N.B: Server hostname can be gotten from running 'hostname' command.

Then restart hostname service and wazuh services.

systemctl restart systemd-hostnamed for hostname service.

If error persist, then edit /etc/hosts file as follows:

Change:

127.0.0.1 localhost localhost.localdomain server_hostname

To:

127.0.0.1 localhost

Then restart hostname service and wazuh services.

Regards,

[Harihara Purohita]

Hi Isaiah,

Thank you for your response!!

As per your suggestion, we have updated the /etc/hosts file but still facing the same error,

With Below error message on Wazuh-dashboard,

ERROR: Failed to send the test message.

[status_exception] {"event_status_list": [{"config_id":"mep8sI0BB9PDbUFMIVuF","config_type":"email","config_name":"TestWazuh","email_recipient_status":[{"recipient":"hariha...@gmail.com","delivery_status":{"status_code":"502","status_text":"sendEmail Error, status:Invalid Addresses"}}],"delivery_status":{"status_code":"502","status_text":"sendEmail Error, status:Invalid Addresses"}}]}

But the email id is correct.

Please find the below log lines from /var/log/maillog log file,

Mar  5 18:06:11 wazuh-server sendmail[27750]: 425DMRDr018438: 425I4A6t027750: sender notify: Warning: could not send message for past 4 hours
Mar  5 18:06:11 wazuh-server sendmail[27750]: 425I4A6t027750: to=< hariha...@gmail.com>, delay=00:00:00, xdelay=00:00:00, mailer=relay, pri=31722, relay=smtp.gmail.com., dsn=4.0.0, stat=Deferred: Connection timed out with smtp.gmail.com.

Thanks,
Haris

[Isaiah Daboh]

Hi Haris,

Please confirm that there is connectivity.

telnet smtp.gmail.com 587

telnet smtp.gmail.com 25

Please share the result of the two.

If there is connectivity and the issue persist, please confirm that Sendmail was properly setup by following the guide.

Regards,

[Harihara Purohita]

Hi Isaiah,

With the above link we are able to send mail successfully.

Thank you for your support.

Thanks,

Haris