Reporting

Why my sendemail.py for alerts gets killed?

sylim_splunk
Splunk Employee
Splunk Employee

I have several reports set up and configured to send email alerts. But I'm not getting emails which appears due to the below WARN messages. Mostly this happens to the reports running at night, like after 9pm..

05-22-2017 19:05:13.201 +0000 WARN script - Script has timed out and will be killed, maxtime=300sec, script=/opt/splunk/bin/python /opt/splunk/etc/apps/search/bin/sendemail.py '"results_link=https://splunk.mysplunk.com.au/app/search/@go?sid=scheduler__my user_searchRMDb6ea072df8e31633_at_1495479600_37189"' '"ssname=ErrorCode Testing"' '"graceful=True"' '"trigger_time=1495479612"' 'results_file="/opt/splunk/var/run/splunk/dispatch/schedulermyusersearch_RMDb6ea072df8e31633_at_1495479600_37189/results.csv.gz"'

This is my configuration, using amazon email service;
In etc/system/local/alert_actions.conf
mailserver = email-smtp.east.amazonaws.com:25
use_tls = 1

Why it takes more than 5 mins for the sendemail.py to send just short email message?

0 Karma
1 Solution

sylim_splunk
Splunk Employee
Splunk Employee

This turns out to be caused by the amazon mailserver limiting max daily emails allowed.

https://stackoverflow.com/questions/34694978/why-does-amazon-ec2-limit-port-25/34695131
-- excerpts --
Amazon EC2 imposes default sending limits on email sent via port 25 and throttles outbound connections if you attempt to exceed those limits. To remove these limits, submit a Request to Remove Email Sending Limitations. You can also connect to Amazon SES via port 465 or port 587, neither of which is throttled.

After changing the port 25 to 587 it appears all good now.

View solution in original post

0 Karma

sylim_splunk
Splunk Employee
Splunk Employee

This turns out to be caused by the amazon mailserver limiting max daily emails allowed.

https://stackoverflow.com/questions/34694978/why-does-amazon-ec2-limit-port-25/34695131
-- excerpts --
Amazon EC2 imposes default sending limits on email sent via port 25 and throttles outbound connections if you attempt to exceed those limits. To remove these limits, submit a Request to Remove Email Sending Limitations. You can also connect to Amazon SES via port 465 or port 587, neither of which is throttled.

After changing the port 25 to 587 it appears all good now.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...