Email alert error "command="sendemail" [Errno 10060] A connection attempt failed because the connected party did not properly respond after a period of time"?

[boopaljothi]

I have installed hmail server in my personal laptop as mail server and have configured an account. Now trying to send an email alert to my personal gmail account using the same, but I am unable to send. I am trying to send email using the search command and getting the below error

Search:

index=main | head 5 | sendemail to=xxxx@gmail.com server=mail.mydomain.com subject="Here is an email notification" message="This is an example message" sendresults=true inline=true format=raw

Error:

command="sendemail", [Errno 10060] A connection attempt failed because the connected party did not properly respond after a period of time, or established connection failed because connected host has failed to respond while sending mail to: XXXX@gmail.com

There are no errors in the splunkd log and I see the same error message in python.log. Please let me know what could be issue.

[rakeshh123 · Accepted solution]

Hello boopaljothi ,
Please check whether u have configured the following settings ......
Go to server settings -----> email settings ----->
Host:smtp.gmail.com:465
enable ssl
Email: x@gmail.com
password:******
save and restart
and use https: in the url( ssl is enabled) Now
If u r not getting mail after restart then go to
1.Gmail --------> Settings -----------> Forwarding and POP/IMAP---------> IMAP Access------>
IMAP Access: enable it ......

2.Gmail --------> Myaccount -----------> Sign-in & security----------> Connected apps & sites------>Allow less secure apps: enable it .......

let me know if it helps

[boopaljothi]

hello rakesh -

thanks for the help. It worked for inline command in search.
below command worked and mail was received.
index=main | head 5 | sendemail to=xxxx@gmail.com server=smtp.gmail.com:465 subject="Here is an email notification" message="This is an example message" sendresults=true inline=true format=raw use_ssl=1

but scheduled alert is still taking the mail server incorrectly. i have tried updating the settings in emails settings and restarted the splunk. also checked the alert_actions.conf and it is set fine.

python log for scheduled alert:

2016-01-31 01:13:10,979 CST ERROR sendemail:115 - Sending email. subject="Splunk Alert: Server error", results_link="http://Boopal-MindPalace:8000/app/search/@go?sid=scheduler__admin__search__RMD5d4bfbc9a7af21f58_at_1...", recipients="[u's.boopal@xxxx']", server="mail.mydomain.com"
2016-01-31 01:13:10,980 CST ERROR sendemail:378 - [Errno 10061] No connection could be made because the target machine actively refused it while sending mail to: xxxx@gmail.com

[rakeshh123]

hello boopaljoti,
Let me know if u r scheduled alert is triggering any alerts ........You can check triggered alerts in Activity....Also see in search reports and alerts----------> whether alert mode is once per result /once per search .........understand the difference between them....make sure the severity is set to critical( i don't why ,but it worked for me).....

No connection could be made because the target machine actively refused it while sending mail to: xxxx@gmail.com: this may be due to u r trying to connect to another server .... in the first setting i specified
Go to server settings -----> email settings ----->Host :port........Give your required sever..

I can see ur link is HTTP not HTTPS......is ssl enabled ?

  let me know ....

[boopaljothi]

hello rakesh

issue has been resolved after i updated the gmail port to 465 and used ssl.

[rakeshh123]

Regards
Rakesh
Vedicsoft Technologies

[boopaljothi]

i found the issue. it seems that savedsearches.conf was not updated. so i updated and it started working fine.

one clarifiication that i would need is in some blogs it is said to use port 587 and in some 465. what is the difference between the two.