EmailEmail temporary disabled - notification:100 - How to fix it?

[ubaid.hayee@kah1]

Hi All,

I was testing notifications and because of the limit of 100 notifications a day on server the email is disabled for a day. Even after increasing the limit and decreasing the disable time I still can't make the notification work.

What I want to know is, how to fix it? Is there a place where email can be enabled ? or removed from disable list ?

Ubaid

[andreas.suess]

Hi Ubaid...

have you reload the config after changes?

<ARCSIGHT_HOME>/bin/arcsight manager-reload-config

This works for dynamic properties like auth.password.age.

I think your parameters are static and need a manager reboot.

Andreas

[mysiddiqui]

Hi,

To re-enable notifications you will have to acknowledge all the pending notifications and incase if you dont have acknowledgement setup you will have to restart ArcSigth manager service.

Regards,

[ubaid.hayee@kah1]

Hi Andreas,

Thanks for the quick reply. I did manager restart after configuration changes but still there was no success. Now even I rebooted the system but no luck.

Regards

Ubaid

[mysiddiqui]

Hi Ubaid ,

Were you receiving notifications before making any changes to the config files. if yes then revert back to old config restart your manager, you should start receiving the notifications

and upload the config details which you wanted to have.

[ubaid.hayee@kah1]

Assalam O Alaikum Yahiya,

Yes I was getting notifications before. The configurations that I added are

notification.aggregation.max_notifications=1000

notification.aggregation.time_window=1h

I have removed the configurations and its almost 1 day passed still email is disabled.

Ubaid

[mysiddiqui]

Walekumsalaam ubaid ,

Sorry for the late reply, did you fix the issue ?

remove the configuration did you mean , now your using the defaults templates and also remove these two parameters which you have added in server.properties

Restart the manager service and notifications should start working.

Also the issue can be identified by looking at the event logs just run an active channel with condition as "Name Contains EmailEmail temporarily disabled

Regards,

Mohammed

[ubaid.hayee@kah1]

Hi,

So eventually I am able to figure out what was going wrong. I was using email template. In Email.vm template I misspelled one variable. Instead of using $sourceUserId I used $sourceUserID. With this case sensitivity issue some Java components were failing and giving message EmailEmail Temporary disabled. This behavior of notification engine is different than the notification body described inside ArcSight where a misspelled variable is sent in email as it is.

Regards

Ubaid