search

seunomosowon / TA-mailclient

This technology adapter add-on fetches emails for Splunk to index from mailboxes using either POP3 or IMAP, with or without SSL.
Apache License 2.0
9 stars 9 forks source link

Changes for a v0.5.1 #1

Closed FLAdista closed 7 years ago

FLAdista commented 7 years ago

Hello, Thank you for your TA-mailclient. In order to use it with a pop3 mailbox, and for use in my projects, I made a few changes to your work. Here they are.

seunomosowon commented 7 years ago

Looks good, I'll test and commit. Thanks for contributing.

seunomosowon commented 7 years ago

Do you mind trying the current version? The line breaker is no longer needed as I now mark the event as complete and with done=True, so I took out the preamble.

FLAdista commented 7 years ago

Hello seunomosowon, I finally tried your new release this morning. However I get an error when fetching the emails, using the same pop account and inputs.conf as before. When reverting to the previous version that I modified, no error.

Here are the log events with "index=_internal sourcetype=splunkd (component=ModularInputs OR component=ExecProcessor) mail.py" :

10-30-2017 11:56:43.430 +0100 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/TA-mailclient/bin/mail.py" ERROR
10-30-2017 11:56:43.334 +0100 INFO  ExecProcessor - message from "python /opt/splunk/etc/apps/TA-mailclient/bin/mail.py" POP3 debug: +OK 
10-30-2017 11:56:43.313 +0100 INFO  ExecProcessor - message from "python /opt/splunk/etc/apps/TA-mailclient/bin/mail.py" POP3 debug: +OK
10-30-2017 11:56:43.302 +0100 INFO  ExecProcessor - message from "python /opt/splunk/etc/apps/TA-mailclient/bin/mail.py" Connecting to mailbox as #########

I tried setting again the password in inputs.conf in case it was lost with the update, but no change in the error.

seunomosowon commented 7 years ago

Hi Francois,

You pulled the last version from Git? Did you just copy the inputs.conf? Check for the app.conf that has the encrypted password too, just to make sure it's on there. You can see some tests that happen automatically on here:

https://travis-ci.org/seunomosowon/TA-mailclient/ https://travis-ci.org/seunomosowon/TA-mailclient/jobs/262823464 https://travis-ci.org/seunomosowon/TA-mailclient/jobs/262819041

The last 2 jobs (links above) also include some automated tests I have on all commit that tests if POP3 retrieval works and tests if the password was encrypted too.

You'll see a line like this: [mail://pop_to_splunk@gmx.com] password = encrypted

Let me know if you find anything. It'll also be best you clean up previous passwords in your app.conf just in case a different password is taking precedence.

Cheers, Seun