getting alerts by email

Hi All,
I am trying to configure email plugin and geting some issue with it.
First off i configured template - simply added one line to the  default
template:

***
*
https://127.0.0.1:8443/?view=alert_summary&origin=alert_listing&analyzerid=$alert.analyzer(-1).analyzerid&messageid=$al
ert.messageid
* $alert.classification.text : $alert.source(0).node.address(0).address ->
$alert.target(0).node.address(0).address
*
* Create Time: $alert.create_time
* Sensor: $alert.analyzer(-1).name - $alert.analyzer(-1).node.name -
$alert.analyzer(-1).node.address(0).address
* User: $alert.target(0).user - $alert.target(0).user.user_id(0).name
#if $alert.correlation_alert.name
* CorrelationAlert name: $alert.correlation_alert.name
#end if
***


After that I've added idmef criteria filter like this:

[idmef-criteria=windows]
rule = alert.classification.text == 'Login failure'
hook = smtp[mailrelay]

So i am started to get emails and looks like it works.But in
/var/log/messages i also see these errors:

prelude-manager: ERROR: could not get value as string for path
'alert.target(0).user': Object type 'class' does not support write
operation. (smtp.c:273 iterate_cb)

What does this mean?

btw when prelude-manager is tryning to send emails i see this warning:
prelude-manager: WARNING: SMTP(NOOP): unexpected server reply: 421
mailrelay.xx.xx Error : timeout exceeded

why prelude-manager sends NOOP command to the mailrelay?

Other applications can send alert emails via this mailrelay without any
problems or warnings.

thanks.
_______________________________________________
Prelude-user site list
[email protected]
http://lists.prelude-ids.org/mailman/listinfo/prelude-user