Open kees-closed opened 5 years ago
I think the problem is this, it's just an educated guess, I didn't have time to check the source code:
MIN_DANGER_LEVEL 1;
EMAIL_ALERT_DANGER_LEVEL 3;
EMAIL_LIMIT 50;
MIN_DANGER_LEVEL
must be less or equal to EMAIL_ALERT_DANGER_LEVEL
, but when the value is less, then it still triggers mail events, which aren't actually sent since the EMAIL_ALERT_DANGER_LEVEL
threshold isn't triggered when the danger level is less than 3 (in this case). But the danger events less than 3 do increment the EMAIL_LIMIT
value, which is set to 50. So even when no mails are actually sent, it does increment that limit, once hit, I receive the "reached email message limit" out of nowhere since I never got other emails since the EMAIL_ALERT_DANGER_LEVEL
wasn't triggered. If this is the case, then I see this as a bug.
With the config below I receive regular emails with the subject "[psad-status] reached email message limit for {{ ip }} on {{ hostname }}" without a message body. I also don't receive intermediate warnings, it seems like it immediately hits the message limit.
Did I configure PSAD wrong? Or did my config trigger a bug? Below is my Ansible template of my psad.conf. Running on Fedora 29 (psad-2.4.6-1.fc29.x86_64).