Hey Mike H, We (the community) and rsyslog/adiscon are getting your emails. Ommail was written by Adiscon (makers of rsyslog). It was specifically written by Rainer, the lead author. It's possible no one knows why and hasn't jumped in. Have you tried capturing the traffic at the rsyslog server headed towards the SMTP server? Eg: tcpdump -i any port 25 and host 172.16.31.15 -w /tmp/outbound-smtp.pcap
If you're not seeing the email body in the packet it's possible the module is bugged. If you see the body of the email in the packet, it's probably not a rsyslog issue. You can also try forcibly setting Body.Enable = "on". "body.template" is not a valid directive according to the docs. https://www.rsyslog.com/doc/configuration/modules/ommail.html if $msg contains 'logdesc="Admin' then { action(type="ommail" server="172.16.31.15" port="25" mailfrom="n...@wantegrity.com" mailto=["mhawk...@wantegrity.com", "r...@saturn.home"] subject.template="mailSubjectAdmin" body.enable="on" action.execonlyonceeveryinterval="2" action.execOnlyWhenPreviousIsSuspended="off" ) } ________________________________ From: rsyslog <rsyslog-boun...@lists.adiscon.com> on behalf of Michael A Hawkins via rsyslog <rsyslog@lists.adiscon.com> Sent: Monday, January 20, 2025 1:40 PM To: rsyslog-users <rsyslog@lists.adiscon.com> Cc: Michael A Hawkins <mhawk...@wantegrity.com> Subject: [rsyslog] ommail module CAUTION: The Sender is located Outside The Organization. Do not click links or open attachments unless you recognize the sender and know the content is safe. Perhaps someone could point out to me why I am not getting any response from anyone. I guess this is my last time asking. Perhaps I am on the wrong email group? Is ommail something that is supported by the rsyslog team directly? Or is it managed by someone else? Hello to everyone, I have the following ommail conf file and it is working except that the mailBody template is not applied to outgoing emails. I searched the documentation and searched the Internet looking for a way to apply a mailBody template to the body of the email but found nothing. You can see I tried body.template but that didn't work. Does anyone have any suggestions? template (name="mailBody" type="string" string="RSYSLOG Alert\\r\\nmsg='%msg%'") template (name="mailSubjectAdmin" type="string" string="ALERT: We got an Admin login/logoff on %hostname%") if $msg contains 'logdesc="Admin' then { action(type="ommail" server="172.16.31.15" port="25" mailfrom="n...@wantegrity.com" mailto=["mhawk...@wantegrity.com", "r...@saturn.home"] subject.template="mailSubjectAdmin" # body.template="mailBody" <<<<<<<<<<<<<<<<< this does not work (when uncommented) action.execonlyonceeveryinterval="2" action.execOnlyWhenPreviousIsSuspended="off" ) } /Mike H -- Wantegrity Inc. Michael A Hawkins, President Stamford, CT 06902 USA Mobile: 203-550-5502 On Sat, 2025-01-11 at 09:12 -0500, Michael A Hawkins via rsyslog wrote: > > Hello everyone, > > I have the following conf file and it is working except that the mailBody > template is not applied to outgoing emails. > I searched the documentation and searched the Internet looking for a way to > apply the mailBody template to the body of > the email but found nothing. You can see I tried body.template but that > didn't work. Does anyone have any suggestions? > > > template (name="mailBody" type="string" string="RSYSLOG > Alert\\r\\nmsg='%msg%'") > template (name="mailSubjectAdmin" type="string" string="ALERT: We got an > Admin login/logoff on %hostname%") > > if $msg contains 'logdesc="Admin' then { > action(type="ommail" server="172.16.31.15" port="25" > mailfrom="n...@wantegrity.com" > mailto=["mhawk...@wantegrity.com", "r...@saturn.home"] > subject.template="mailSubjectAdmin" > # body.template="mailBody" <<<<<<<<<<<<<<<<< this does not work (when > uncommented) > action.execonlyonceeveryinterval="2" > action.execOnlyWhenPreviousIsSuspended="off" > ) > } > > /Mike H > _______________________________________________ > rsyslog mailing list > https://can01.safelinks.protection.outlook.com/?url=https%3A%2F%2Flists.adiscon.net%2Fmailman%2Flistinfo%2Frsyslog&data=05%7C02%7Cmichael.redbourne%40bulletproofsi.com%7Cffb953c37bff4b693e6a08dd38fbcccc%7C9a63d13853ea411bbe8458b7e2570747%7C1%7C0%7C638729376363988691%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C0%7C%7C%7C&sdata=r%2F30qbHV66FU8c%2FGWWoGT%2B4P%2BlJz0IZOxpvzmj%2FNx7o%3D&reserved=0<https://lists.adiscon.net/mailman/listinfo/rsyslog> > https://can01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.rsyslog.com%2Fprofessional-services%2F&data=05%7C02%7Cmichael.redbourne%40bulletproofsi.com%7Cffb953c37bff4b693e6a08dd38fbcccc%7C9a63d13853ea411bbe8458b7e2570747%7C1%7C0%7C638729376364010041%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C0%7C%7C%7C&sdata=4oaQ2C94DJ5Vs9yWKoifFp0ZbqmhPlweuxo9WsSLrd0%3D&reserved=0<http://www.rsyslog.com/professional-services/> > What's up with rsyslog? Follow > https://can01.safelinks.protection.outlook.com/?url=https%3A%2F%2Ftwitter.com%2Frgerhards&data=05%7C02%7Cmichael.redbourne%40bulletproofsi.com%7Cffb953c37bff4b693e6a08dd38fbcccc%7C9a63d13853ea411bbe8458b7e2570747%7C1%7C0%7C638729376364021843%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C0%7C%7C%7C&sdata=w%2B42gbQE7R21y7etGUtsR40o9zWAm2LA1%2BE4d6aY3ps%3D&reserved=0<https://twitter.com/rgerhards> > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of > sites beyond our control. PLEASE > UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT. > _______________________________________________ rsyslog mailing list https://can01.safelinks.protection.outlook.com/?url=https%3A%2F%2Flists.adiscon.net%2Fmailman%2Flistinfo%2Frsyslog&data=05%7C02%7Cmichael.redbourne%40bulletproofsi.com%7Cffb953c37bff4b693e6a08dd38fbcccc%7C9a63d13853ea411bbe8458b7e2570747%7C1%7C0%7C638729376364033059%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C0%7C%7C%7C&sdata=b89Y5hZhegnzsuU0KrizSgHBgJ5HaHimI0CSNoZ63q4%3D&reserved=0<https://lists.adiscon.net/mailman/listinfo/rsyslog> https://can01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.rsyslog.com%2Fprofessional-services%2F&data=05%7C02%7Cmichael.redbourne%40bulletproofsi.com%7Cffb953c37bff4b693e6a08dd38fbcccc%7C9a63d13853ea411bbe8458b7e2570747%7C1%7C0%7C638729376364044779%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C0%7C%7C%7C&sdata=j3Na6rkojBzO7auoL0AzgRZwyWDJXnEpS96xhVcdJv0%3D&reserved=0<http://www.rsyslog.com/professional-services/> What's up with rsyslog? Follow https://can01.safelinks.protection.outlook.com/?url=https%3A%2F%2Ftwitter.com%2Frgerhards&data=05%7C02%7Cmichael.redbourne%40bulletproofsi.com%7Cffb953c37bff4b693e6a08dd38fbcccc%7C9a63d13853ea411bbe8458b7e2570747%7C1%7C0%7C638729376364055402%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C0%7C%7C%7C&sdata=7uYqwYt9KmEUKPtePy7ahoRo8msf5f5c9a8cJQKxmGY%3D&reserved=0<https://twitter.com/rgerhards> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT. ________________________________________ This e-mail communication (including any or all attachments) is intended only for the use of the person or entity to which it is addressed and may contain confidential and/or privileged material. If you are not the intended recipient of this e-mail, any use, review, retransmission, distribution, dissemination, copying, printing, or other use of, or taking of any action in reliance upon this e-mail, is strictly prohibited. If you have received this e-mail in error, please contact the sender and delete the original and any copy of this e-mail and any printout thereof, immediately. If you have any questions or concerns, please contact our Customer Service Desk at 1-877-274-2349. Your co-operation is appreciated. Le pr?sent courriel (y compris toute pi?ce jointe) s'adresse uniquement ? son destinataire, qu'il soit une personne ou un organisme, et pourrait comporter des renseignements privil?gi?s ou confidentiels. Si vous n'?tes pas le destinataire du courriel, il est interdit d'utiliser, de revoir, de retransmettre, de distribuer, de diss?miner, de copier ou d'imprimer ce courriel, d'agir en vous y fiant ou de vous en servir de toute autre fa?on. Si vous avez re?u le pr?sent courriel par erreur, pri?re de communiquer avec l'exp?diteur et d'?liminer l'original du courriel, ainsi que toute copie ?lectronique ou imprim?e de celui-ci, imm?diatement. Si vous avez des questions ou des pr?occupations, veuillez contacter notre centre de service ? la client?le au 1-877-274-2349. Nous sommes reconnaissants de votre collaboration. ________________________________________ _______________________________________________ rsyslog mailing list https://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
