ERROR:root:Error while running alert email: Error connecting to SMTP host: [Errno 111] Connection refused

[ShaneC-C-Y]

Hi everyone, I have finished elastalert-create-index and got the status created. But when I started to add log into elasticsearch, elastalert can't send out email to alert me.

ERROR:root:Error while running alert email: Error connecting to SMTP host: [Errno 111] Connection refused
INFO:elastalert:Ignoring match for silenced rule Example rule
INFO:elastalert:Ignoring match for silenced rule Example rule
INFO:elastalert:Ignoring match for silenced rule Example rule
INFO:elastalert:Ignoring match for silenced rule Example rule
INFO:elastalert:Ignoring match for silenced rule Example rule
INFO:elastalert:Ran Example rule from 2016-07-11 17:34 UTC to 2016-07-11 17:37 UTC: 543 query hits, 108 matches, 0 alerts sent
INFO:elastalert:Sleeping for 59 seconds

I have checked the previous post (https://github.com/Yelp/elastalert/issues/256) and set my example_rules/example_frequency.yaml file as following

# (Required)
# The alert is use when a match is found
alert:
- "email"

# (required, email specific)
# a list of email addresses to send alerts to
email:
#- "elastalert@example.com"
- "--my email--"
from_addr: "--my email--"

[Qmando]

You must use an SMTP server to send email. There is a setting smtp_host which you need to set. It's trying to default localhost but no server is listening there.

[ShaneC-C-Y]

Thank for your help, sorry I am not familiar how to use SMTP server. This is my setting:

# (required, email specific)
# a list of email addresses to send alerts to
email:
#- "elastalert@example.com"
- "chienyuc@elementaltechnologies.com"
smtp_host: "smtp.gmail.com"
smtp_port: 587
smtp:ssl: true
from_addr: "chienyuc@elementaltechnologies.com"
smtp_auth_file: '/opt/elastalert/smtp_auth_file.yaml'

and the smtp_auth_file.yaml is

---
user: ---my-full-email---
password: ---my-email-login-password
...

but it still doesn't work

[Qmando]

You have a typo. smtp_ssl: true instead of smtp:ssl: true. Also, try port 465 is for SSL gmail smtp, 587 is for TLS (STARTTLS, which elastalert does support too, but then you don't want smtp_ssl set)

[ShaneC-C-Y]

hi Quentin Long, thank you very much. Now I can receive the email. My setting is the following:

email:
#- "elastalert@example.com"
- "chienyuc@elementaltechnologies.com"
smtp_host: "smtp.gmail.com"
smtp_port: 465
smtp_ssl: true
from_addr: "chienyuc@elementaltechnologies.com"
smtp_auth_file: '/opt/elastalert/smtp_auth_file.yaml'

if I keep port 587, the error message is like this:

ERROR:root:Error while running alert email: Error connecting to SMTP host: [Errno 1] _ssl.c:510: error:140770FC:SSL routines:SSL23_GET_SERVER_HELLO:unknown protocol

BTW, I received this error message if I didn't create I new password

ERROR:root:Error while running alert email: Error connecting to SMTP host: (534, '5.7.9 Application-specific password required. Learn more at\n5.7.9  https://support.google.com/accounts/answer/185833 i187sm5150287pfc.62 - gsmtp')

So we need to create another password to use, steps are here: (https://support.google.com/accounts/answer/185833)

Hope it can help others, thank you again!

[Mozart4242]

hi Quentin Long, thank you very much. Now I can receive the email. My setting is the following:

email:
#- "elastalert@example.com"
- "chienyuc@elementaltechnologies.com"
smtp_host: "smtp.gmail.com"
smtp_port: 465
smtp_ssl: true
from_addr: "chienyuc@elementaltechnologies.com"
smtp_auth_file: '/opt/elastalert/smtp_auth_file.yaml'

if I keep port 587, the error message is like this:

ERROR:root:Error while running alert email: Error connecting to SMTP host: [Errno 1] _ssl.c:510: error:140770FC:SSL routines:SSL23_GET_SERVER_HELLO:unknown protocol

BTW, I received this error message if I didn't create I new password

ERROR:root:Error while running alert email: Error connecting to SMTP host: (534, '5.7.9 Application-specific password required. Learn more at\n5.7.9  https://support.google.com/accounts/answer/185833 i187sm5150287pfc.62 - gsmtp')

So we need to create another password to use, steps are here: (https://support.google.com/accounts/answer/185833)

Hope it can help others, thank you again!

hello, can you please show me the exact content of you "smtp_auth_file.yaml" file ? my setting is as same as your's but the error still exist (errno 111 connection refused) and i am using orginazation's internal mail server... thanks

[nsano-rururu]

This issue may be due to this not being merged Add parameter 'smtp_ca_file', fix STARTTLS problem #2681

[nsano-rururu]

Launch a web browser on the terminal running ElastAlert, access the Google settings screen, go to the Google account → App that can access the account → Allow less secure apps: Disable → Change to enable. When I specified the Gmail address with from_addr and confirmed the operation, it worked normally.

smtp_port: 587

smtp_host: "smtp.gmail.com" 
smtp_port: 587 
smtp_ssl: false
smtp_auth_file: '/opt/elastalert/smtp/smtp_auth_user.yaml"

smtp_auth_user.yaml

user: xxx@gmail
password: xxx

smtp_port: 465

smtp_host: "smtp.gmail.com" 
smtp_port: 465 
smtp_ssl: true
smtp_auth_file: '/opt/elastalert/smtp/smtp_auth_user.yaml"

smtp_auth_user.yaml

user: xxx@gmail
password: xxx

[gspgsp]

You have a typo. smtp_ssl: true instead of smtp:ssl: true. Also, try port 465 is for SSL gmail smtp, 587 is for TLS (STARTTLS, which elastalert does support too, but then you don't want smtp_ssl set)

it works for ,just set smtp_ssl: true