ESM Emailed Report Notifications Stops

[vigneshwar]

We have never gotten the root cause yet. We usually have to reboot ESM and or ArcMC to deal with it.  All our reports are set to run from schedule and email receipients. We would go for months without issue but suddently the email part would not work. The reports run and get archived but the emails never go out.

Any suggestion for resolution?

Thanks

Vignesh

[mariliw]

Hello

Is it possible for you to open a service request case directly to Arcsight? we need more details in order to understand your network environment. That would be easier for us and  maybe  a webex session and some logs.

regards

Maritza

[vigneshwar]

Can you email the web link to the new software support portal for MicroFocus?

I only have the link to the HPE portal.

Thanks

Vignesh

[mariliw]

Hi Vignesh

Try this

https://softwaresupport.hpe.com/group/softwaresupport/case-manager

(Please provide details: ESM version? RHEL version? SMTP internal or external? did it work before? send error message )

I hope it helps

Maritza

[donpat03]

ArcSight has some built in SPAM controls related to notifications.  Once a notification limit is reached it will stop sending out notifications/emails.   This might be your problem depending on the volume.

These are the default values found in the /opt/arcsight/manager/config/server.defaults.properties file

notification.aggregation.max_notifications=100
notification.aggregation.time_window=1d

you  might want add new values to the  server.properties file which will override the default values.  Here is an example.

server.properties:notification.aggregation.max_notifications=500

notification.aggregation.time_window=1h

[Darren Hammond]

Hi Vignesh,

A little additional information that builds on the previous responses.

If indeed your notifications are being quenched because too many emails are being sent to a single destination per day, then you will see a message like this in the server log:

[2015-12-14 17:07:01,135][INFO ][default.com.arcsight.notification.d] Security team has 101 notifications

[2015-12-14 17:07:01,135][WARN ][default.com.arcsight.notification.PendingAlert] Security team is overflowing! Discarding notification

This example is for the destination "Security team".   A restart of the manager will clear this. As mentioned by a previous contributor, it is possible to adjust the properties that affect this behaviour as per document https://softwaresupport.hpe.com/group/softwaresupport/search-result/-/facetsearch/document/KM1270032.

Another possible issue is if you are using the bundled internal mail server provided with ESM (referred to as the "builtin").  There is a potential issue with the builtin where sometimes it can stop forwarding emails for an unknown reason. Again a manager restart will reset it.

If you are using the builtin then the following will be set to true in /opt/arcsight/manager/config/server.properties (or maybe server.defaults.properties if someone edited it there):

email.use.builtin.mailserver=true

If you are using the builtin server and continue to see the issue, then you could consider sending directly to an available external email server or if one is not available, to consider setting up an email relay on another server (using for example Postfix).   You might want to investigate the issue through a support case before taking this route since there is some email debug which could shed some light on anything else that might be affecting mail delivery.

I hope that this helps Vignesh,

Best regards,

Darren