Before I go to TAC, wanted to see if someone here can show me the way.
Have a MARS-100E local controller setup.
Have created a couple of user reports to run hourly and have configured it for recipients to go to me.
I can look at the GUI and I see that the reports are generated but I am not seeing the reports in my email.
I have also configured a rule to send me an alert if it gets fired and I have seen emails for this, so I know that I do have email connectivity.
Any thoughts on what I am missing here?
One othere thing is that the format type for the report is Total View if that makes a difference.
Solved! Go to Solution.
If you had access to the mail server logs, that would might be best for troubleshooting. Have you tried getting a trace from the MARS command line?
[pnadmin]$ tcpdump -s0 -A host mailserver.mycompany.com and port 25
this will pretty much show you all the details.
Thanks for the suggestion.
I did do a tcpdump port 25 during the time the report was being created. I actually did it on trapping both interfaces. There was no traffic seen, so it is not even trying to send the report.
I know that it is sending emails to me for incedents but not the report.
okay. well, when you email from a report you're actually not exactly selecting the same thing as when you email from a rule. when emailing from a report, you're actually directly selecting a user from the list of local users in MARS. When you email from a rule, you're selecting an action [that you've created] that is configured with an email recipient(and/or SMS and/or page, etc). seems a trivial difference, but may be relevant in this case. Your sure you're using the exact same user for both right?
Yes, that is where I am right now as well. Waiting for TAC to get back to me.
And you are correct, I have not seen anything in the logs during the time the report is supposed to be generated as to why it might not be sent.
Thanks for your thoughts and suggestions.
Glab to do it.
Great session with a Cisco TAC engineer.
What we were able to narrow it down to was that when I had just myself as the recieptent, I got the email. Then I got our email server guy to look at the logs on the server. Turns our one of the groups that was initially included for notification had a bad email address and our, do not laugh, groupwise email server just held the whole thing.
Found the bad email address, corrected and as they say, the mail went through.
Part of the key was to watch the mail going out of the MARS box with the following:
tcpdump -i eth1 -X port25
the -i eth1 is to watch the interface that was sending the mail out and the -X was to get a decode on the packets and port25 to just see the smtp traffic.
remember with your putty session to have a big enough line buffer or at lease send it to a log file.