Hi Brinkmann It seems that the MAILSERVER and port don't work well. For example, the MAILSERVER is unreachable. You can check it and add a extra action with action.execOnlyWhenPreviousIsSuspended = "on" also, you can set action.resumeretrycount and action.resumeInterval in your ommail action.
click here for detail: https://www.rsyslog.com/doc/master/configuration/actions.html Till Brinkmann <[email protected]> 于2018年8月2日周四 下午2:48写道： > rsyslog 8.32.0-1ubuntu4 > > lsb_release -a > No LSB modules are available. > Distributor ID: Ubuntu > Description: Ubuntu 18.04.1 LTS > Release: 18.04 > Codename: bionic > > Hi there, > > I try to react on syslog messages from a external device by sending emails > to our admins. > > module(load="ommail") > > template (name="mailBody" type="string" string="RSYSLOG > Alert\\r\\nmsg='%msg%'") > > if $msg contains "Invalid Credentials" then { > action(type="ommail" server="MAILSERVER" port="587" > mailfrom="SYSLOGMAILER" > mailto="[email protected]<mailto:[email protected]>" > subject.text="mailSubject") > } > > I can find following error that i do not understand in the syslog. > > rsyslogd[14116]: action 'action 0' suspended (module 'ommail'), retry 0. > There should be messages before this one giving the reason for suspension. > [v8.32.0 try http://www.rsyslog.com/e/2007 ] > > Does anyone can help ? > > THANKS !! TILL > > _______________________________________________ > rsyslog mailing list > http://lists.adiscon.net/mailman/listinfo/rsyslog > http://www.rsyslog.com/professional-services/ > What's up with rsyslog? Follow https://twitter.com/rgerhards > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad > of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you > DON'T LIKE THAT. > -- eSX _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
