Re: getting alerts by email

Hi Alec,

Le lundi 18 août 2008 à 15:37 +0300, Alec a écrit :
> I am trying to configure email plugin and geting some issue with it.
> First off i configured template - simply added one line to the  default
> template:
> 
> * User: $alert.target(0).user - $alert.target(0).user.user_id(0).name
> 
> After that I've added idmef criteria filter like this:
>
> So i am started to get emails and looks like it works.But in
> /var/log/messages i also see these errors:
> 
> prelude-manager: ERROR: could not get value as string for path
> 'alert.target(0).user': Object type 'class' does not support write
> operation. (smtp.c:273 iterate_cb)
> What does this mean?
> 

This is because you are specifying a path to an object, rather than a
path to a value: alert.target(0).user contain other objects/value, but
is not a value per se.

Currently we are not capable of translating from one random object to
string (although that will probably happen sooner or later), thus it is
required to use path to value.


> btw when prelude-manager is tryning to send emails i see this warning:
> prelude-manager: WARNING: SMTP(NOOP): unexpected server reply: 421
> mailrelay.xx.xx Error : timeout exceeded
> 
> why prelude-manager sends NOOP command to the mailrelay?

Prelude-Manager has to perform reporting as fast as possible, and thus
try to keep the connection alive rather than connecting to the mail
server each time an event is received. NOOP are used for this purpose.

After this error, the plugin should reconnect the mail server. Can you
confirm this behavior?

Regards,

-- 
Yoann Vandoorselaere | Responsable R&D / CTO | PreludeIDS Technologies
Tel: +33 (0)8 70 70 21 58                  Fax: +33(0)4 78 42 21 58
http://www.prelude-ids.com

_______________________________________________
Prelude-user site list
[email protected]
http://lists.prelude-ids.org/mailman/listinfo/prelude-user