automatic email of scheduled reports

[RICHARD MESSINGER]

Before I go to TAC, wanted to see if someone here can show me the way.

Have a MARS-100E local controller setup.

Have created a couple of user reports to run hourly and have configured it for recipients to go to me.

I can look at the GUI and I see that the reports are generated but I am not seeing the reports in my email.

I have also configured a rule to send me an alert if it gets fired and I have seen emails for this, so I know that I do have email connectivity.

Any thoughts on what I am missing here?

One othere thing is that the format type for the report is Total View if that makes a difference.

Thanks

[mhellman]

If you had access to the mail server logs, that would might be best for troubleshooting. Have you tried getting a trace from the MARS command line?

[pnadmin]$ tcpdump -s0 -A host mailserver.mycompany.com and port 25

this will pretty much show you all the details.

[RICHARD MESSINGER]

Thanks for the suggestion.

I did do a tcpdump port 25 during the time the report was being created. I actually did it on trapping both interfaces. There was no traffic seen, so it is not even trying to send the report.

I know that it is sending emails to me for incedents but not the report.

[mhellman]

okay. well, when you email from a report you're actually not exactly selecting the same thing as when you email from a rule. when emailing from a report, you're actually directly selecting a user from the list of local users in MARS. When you email from a rule, you're selecting an action [that you've created] that is configured with an email recipient(and/or SMS and/or page, etc). seems a trivial difference, but may be relevant in this case. Your sure you're using the exact same user for both right?

[RICHARD MESSINGER]

yes, I am sure that the user is the same in both the event and the report.

[mhellman · Accepted solution]

well then, I don't think you're "missing" anything and there isn't much more you can do.

sounds like a TAC case then. I don't suppose there's anything interesting in the log files?

[RICHARD MESSINGER]

Yes, that is where I am right now as well. Waiting for TAC to get back to me.

And you are correct, I have not seen anything in the logs during the time the report is supposed to be generated as to why it might not be sent.

Thanks for your thoughts and suggestions.

[pmccubbin]

Please post the results of your conversation with TAC. The troubleshooting process would by of help to everyone. Thanks.

[RICHARD MESSINGER]

Glab to do it.

Great session with a Cisco TAC engineer.

What we were able to narrow it down to was that when I had just myself as the recieptent, I got the email. Then I got our email server guy to look at the logs on the server. Turns our one of the groups that was initially included for notification had a bad email address and our, do not laugh, groupwise email server just held the whole thing.

Found the bad email address, corrected and as they say, the mail went through.

Part of the key was to watch the mail going out of the MARS box with the following:

tcpdump -i eth1 -X port25

the -i eth1 is to watch the interface that was sending the mail out and the -X was to get a decode on the packets and port25 to just see the smtp traffic.

remember with your putty session to have a big enough line buffer or at lease send it to a log file.