MARS Rules not firing using 6.0.3 (parched version)

Unanswered Question
May 26th, 2009
User Badges:
  • Bronze, 100 points or more


I need to create a rule where MARS can send an email to admin when any port is down

but when I try by shutting down the test port, MARS is firing system rule "Network config changes".

So I have two problems custom rule not firing and email alert.

email address is configured in action tab.


Screen shot of custom rule is attached.

  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 5 (2 ratings)
nomair_83 Tue, 05/26/2009 - 08:29
User Badges:
  • Bronze, 100 points or more

Hmm not it seems that rule is firing but still admin can not recieve email alert about that incident.

pmccubbin Wed, 05/27/2009 - 13:53
User Badges:
  • Silver, 250 points or more

Can anything be emailed from the MARS box? Try scheduling a report to be run and have it sent to yourself. All I am suggesting is that you rule out whether your email server is not accepting mail from MARS.

Hope this helps.

Farrukh Haroon Thu, 05/28/2009 - 00:16
User Badges:
  • Red, 2250 points or more

As Paul stated, you first have to check if email notification is configured properly. For example you might need to Add the MARS IP address in your SMTP server to allow it to relay.

Then instead of trying this on a custom rule, take one of the built-in rules you know fires a lot on your network. 'Clone' it and add the email action to it. Everytime the incident fires you will see this 'Email Admin' action under the 'Actions' field on the 'Incidents' page.




This Discussion