錯誤：sendemail:1668 - Splunkd後台程式沒有響應

適用性

說明

警報每小時安排一次，警報動作會作為電子郵件傳送，警報會被觸發，但不會作為電子郵件傳送。

08-30-2024 14:39:11.596 +0800 INFO  SavedSplunker - savedsearch_id="", search_type=<"">, search_streaming=0, user=<"">, app="analog_silicon_analysis", savedsearch_name=<>, priority=default, status=success, digest_mode=1, durable_cursor=0, scheduled_time=1724999940, window_time=0, dispatch_time=1724999941, run_time=9.824, result_count=0, alert_actions="", sid=<>, suppressed=0, thread_id="AlertNotifierWorker-0", workload_pool=""

調查

經調查，在splunkd.log中觀察到以下錯誤：

ERROR ScriptRunner [271749 AlertNotifierWorker-1] - stderr from '/opt/splunk/bin/python3.7 /opt/splunk/etc/apps/search/bin/sendemail.py "results_link=<> sid=scheduler__admin_cHVibGljX3Jlc291cmNl__RMD54f5021f61fb80dd3_at_1724997000_14446_2D86E62A-9636-41C8-88D9-DB416CDB1A22" "ssname=[RA] getResourceUsageByProjHostgroups" "graceful=True" "trigger_time=1724997016" results_file="/opt/splunk/var/run/splunk/dispatch/scheduler__admin_cHVibGljX3Jlc291cmNl__RMD54f5021f61fb80dd3_at_1724997000_14446_2D86E62A-9636-41C8-88D9-DB416CDB1A22/results.csv.gz" "is_stream_malert=False"': ERROR:root:(552, b'5.3.4 Message size exceeds fixed maximum message size', 'splunk@abcsplksh23') while sending mail to: abc@gmail.com

— 這表示以事件數量較多的電子郵件傳送警報存在限制。在這種情況下，為了避免此問題，請將結果匯出為CSV而不是電子郵件。 

— 但是，我們注意到事件數量較少的警報仍然沒有作為電子郵件被觸發。

— 在/opt/splunk/var/log/splunk/python.log中，填充以下錯誤：

ERROR sendemail:1668 - Splunkd daemon is not responding: ('Error connecting to /servicesNS/abcsplksh23/arftool/saved/searches/%5BMMSIM%5D%20Max%20Job%20Violation%20Alert: The read operation timed out',)

解析

此錯誤消息指示超時問題。 

要解決此問題，請執行以下步驟：

i.導航至$SPLUNK_HOME/etc/system/local/web.conf

二。增加超時值 

splunkdConnectionTimeout =  (default=30)

* The amount of time, in seconds, to wait before timing out when communicating with
splunkd.
* Must be at least 30.
* Values smaller than 30 will be ignored, resulting in the use of the
default value
* Default: 30

增加超時值後，電子郵件將如預期那樣被觸發。

相關連結

web.conf