Mail alerts for Wazuh and Zeek

[juddcbrown]

Greetings,

I have set up the mail configs for Zeek and Wazuh as specified in the documentation (/opt/so/conf/wazuh/ossec.conf and ../zeek/zeekctl.cfg).

Postfix is running fine, with all mail to root being forwarded to my email address via /etc/aliases.

Problem is I'm not seeing any info from either app. I see an occasional Cron email, but nothing from Wazuh or Zeek.

Any thoughts on how I've gone wrong?

Thanks!

[juddcbrown]

[weslambert]

I think the issue here might be the fact that these services are running in their own Docker container, and you are specifying the SMTP server as localhost (which would be interpreted as local to the container). You might try the hostname or IP of the box itself to see if it works better for you.

[juddcbrown]

Thanks Wes. Would the container have its own mail log file? I don't see any logs written to /var/log/maillog other than postfix testing (mail -s Test root).

[weslambert]

I'd have to test -- did you try changing the SMTP server address to point to the host?

[juddcbrown]

Wes, that did fix it. Thanks much!

On Fri, Mar 26, 2021 at 15:32 weslambert ***@***.***> wrote: I'd have to test -- did you try changing the SMTP server address to point to the host? — You are receiving this because you authored the thread. Reply to this email directly, view it on GitHub <#3574 (reply in thread)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AH4XT7SFRYEESGD257V6E6DTFTVO5ANCNFSM4ZTKOINA> .

-- Judd Brown