• Support
  • Forums
  • Blogs

Email alerts won't stop

mikeazmikeaz

New Life Form
I've setup OSSIM and configured the email relay with my email address, then I configured an action and added it to a policy. Now I can't get the system to stop sending me email alerts. I've removed all policies and actions, reloaded, and even rebooted. The emails just keep coming :/  The only way I can get them to stop is to disable email relay.

This is a basic one server install with little configuration. The * policy_id: field of each email is the same, but there are no policies or actions configured. 

What am I missing? Is there a setting somewhere else that is triggering these emails?

Is there another place where email alerts might be configured/triggering?

Share post:

Answers

  • Where are the email settings located in the cli? I'd like to double-check conf files, etc. Every time I re-enable email relay I get spammed by alienvault even though there are no policies or actions defined.
  • Mikeaz,

    Can you check under Configuration > Administration > Main > Tickets to make sure you are not sending new emails on any tickets created along with auto ticket generation?

    Additionally, make sure you selected "Reload Policies" (ossim-server) after changing policy configuration (it will be highlighted in red on the policy page if not completed), and confirm that you are not receiving deferred messages from before you disabled the policy.
  • Configuration > Administration > Main > Tickets 
       Open Tickets for new alarms automatically? -> No
       Send email notification -> No
       Maximum days for email notification -> 15    What does this setting mean???

    Reload Policies -> Green

    I don't think I'm receiving deferred messages, they all look like new messages when I re-enable email alerts. 

  • All the emails I get have this as the username. I have no policies configured with an Action. The system is just sending these, but I can't figure out where the config is to change any settings to affect this.

    * username:      avapi
Sign In or Register to comment.