ESM Emailed Report Notifications Stops
We have never gotten the root cause yet. We usually have to reboot ESM and or ArcMC to deal with it. All our reports are set to run from schedule and email receipients. We would go for months without issue but suddently the email part would not work. The reports run and get archived but the emails never go out.
Any suggestion for resolution?
Is it possible for you to open a service request case directly to Arcsight? we need more details in order to understand your network environment. That would be easier for us and maybe a webex session and some logs.
(Please provide details: ESM version? RHEL version? SMTP internal or external? did it work before? send error message )
I hope it helps
ArcSight has some built in SPAM controls related to notifications. Once a notification limit is reached it will stop sending out notifications/emails. This might be your problem depending on the volume.
These are the default values found in the /opt/arcsight/manager/config/server.defaults.properties file
you might want add new values to the server.properties file which will override the default values. Here is an example.
A little additional information that builds on the previous responses.
If indeed your notifications are being quenched because too many emails are being sent to a single destination per day, then you will see a message like this in the server log:
[2015-12-14 17:07:01,135][INFO ][default.com.arcsight.notification.d] Security team has 101 notifications
[2015-12-14 17:07:01,135][WARN ][default.com.arcsight.notification.PendingAlert] Security team is overflowing! Discarding notification
This example is for the destination "Security team". A restart of the manager will clear this. As mentioned by a previous contributor, it is possible to adjust the properties that affect this behaviour as per document https://softwaresupport.hpe.com/group/softwaresupport/search-result/-/facetsearch/document/KM1270032.
Another possible issue is if you are using the bundled internal mail server provided with ESM (referred to as the "builtin"). There is a potential issue with the builtin where sometimes it can stop forwarding emails for an unknown reason. Again a manager restart will reset it.
If you are using the builtin then the following will be set to true in /opt/arcsight/manager/config/server.properties (or maybe server.defaults.properties if someone edited it there):
If you are using the builtin server and continue to see the issue, then you could consider sending directly to an available external email server or if one is not available, to consider setting up an email relay on another server (using for example Postfix). You might want to investigate the issue through a support case before taking this route since there is some email debug which could shed some light on anything else that might be affecting mail delivery.
I hope that this helps Vignesh,
If you find that this or any post resolves your issue, please be sure to mark it as an accepted solution.