24 Apr
2012
24 Apr
'12
10:04 a.m.
#814: Fix MailAlarmsTo
----------------------------+--------------------------
Reporter: Tyler.Schoenke | Type: Problem
Status: new | Priority: Normal
Milestone: | Component: BroControl
Version: git/master | Keywords: MailAlarmsTo
----------------------------+--------------------------
In 1.5 there was a MailAlarmsTo variable that could be set in the
broctl.cfg file. That functionality seems to be missing from 2.0. It is
handy to send only alerts (alarms) to a separate email address than the
summary reports.
Here were the default variables in 1.5 etc/broctl.cfg:
{{{
MailTo = bromessage@localhost
MailAlarmsTo = broalert@localhost
}}}
Thanks,
Tyler
--
Ticket URL: <http://tracker.bro-ids.org/bro/ticket/814>
Bro Tracker <http://tracker.bro-ids.org/bro>
Bro Issue Tracker
24 Apr
24 Apr
3:13 p.m.
#814: Fix MailAlarmsTo
-----------------------------+--------------------------
Reporter: Tyler.Schoenke | Owner:
Type: Problem | Status: new
Priority: Normal | Milestone:
Component: BroControl | Version: git/master
Resolution: | Keywords: MailAlarmsTo
-----------------------------+--------------------------
Comment (by seth):
broctl.cfg file. That functionality seems to be
missing from 2.0. It
is
handy to send only alerts (alarms) to a separate email
address than the
summary reports.
For more context, when I looked into this yesterday, the option is
implemented partially in broctl, but it seems that I missed the
implementation in Bro.
--
Ticket URL: <http://tracker.bro-ids.org/bro/ticket/814#comment:0>
Bro Tracker <http://tracker.bro-ids.org/bro>
Bro Issue Tracker
3:18 p.m.
#814: Fix MailAlarmsTo
-----------------------------+--------------------------
Reporter: Tyler.Schoenke | Owner:
Type: Problem | Status: new
Priority: Normal | Milestone: Bro2.1
Component: BroControl | Version: git/master
Resolution: | Keywords: MailAlarmsTo
-----------------------------+--------------------------
Changes (by robin):
* milestone: => Bro2.1
--
Ticket URL: <http://tracker.bro-ids.org/bro/ticket/814#comment:1>
Bro Tracker <http://tracker.bro-ids.org/bro>
Bro Issue Tracker
27 Jul
27 Jul
9:12 a.m.
#814: Fix MailAlarmsTo
-----------------------------+--------------------------
Reporter: Tyler.Schoenke | Owner:
Type: Problem | Status: new
Priority: Normal | Milestone: Bro2.1
Component: BroControl | Version: git/master
Resolution: | Keywords: MailAlarmsTo
-----------------------------+--------------------------
Comment (by robin):
Is this still planned for 2.1? If so, before the beta?
--
Ticket URL: <http://tracker.bro-ids.org/bro/ticket/814#comment:2>
Bro Tracker <http://tracker.bro-ids.org/bro>
Bro Issue Tracker
1 Aug
1 Aug
8:29 a.m.
#814: Fix MailAlarmsTo
-----------------------------+--------------------------
Reporter: Tyler.Schoenke | Owner:
Type: Problem | Status: new
Priority: Normal | Milestone: Bro2.1
Component: BroControl | Version: git/master
Resolution: | Keywords: MailAlarmsTo
-----------------------------+--------------------------
Comment (by dnthayer):
Not sure what the expected behavior should be: currently, notices with
action ACTION_EMAIL are
emailed and notices with action ACTION_ALARM are not (but you can apply
both actions to
a single notice if you want). During each log rotation, two summary
emails are sent:
one that lists all notices with action ACTION_ALARM that occurred since
the last log rotation,
and the other is the connection summary report.
So, the "MailAlarmsTo" would specify the email address for the alarm
summary email, and
the "MailTo" would specify the email address for notices with action
ACTION_EMAIL (and for
the connection summary report that is sent each time log rotation occurs),
right?
--
Ticket URL: <http://tracker.bro-ids.org/bro/ticket/814#comment:3>
Bro Tracker <http://tracker.bro-ids.org/bro>
Bro Issue Tracker
2 Aug
2 Aug
2:02 p.m.
#814: Fix MailAlarmsTo
-----------------------------+--------------------------
Reporter: Tyler.Schoenke | Owner:
Type: Problem | Status: new
Priority: Normal | Milestone: Bro2.1
Component: BroControl | Version: git/master
Resolution: | Keywords: MailAlarmsTo
-----------------------------+--------------------------
Comment (by dnthayer):
In [a30cbd3affad8ab561b1ed49bf58b8368152bb82/broctl]:
{{{
#!CommitTicketReference repository="broctl"
revision="a30cbd3affad8ab561b1ed49bf58b8368152bb82"
Fix MailAlarmsTo broctl config option
This change writes the value of the broctl config option MailAlarmsTo
to the appropriate bro script variable, so that alarm summary emails
are sent to the address specified with this config option (previously,
this config option was not used anywhere). As before, if the user does
not
specify a value for this option, then the value of the MailTo config
option is used by default.
Addresses #814.
}}}
--
Ticket URL: <http://tracker.bro-ids.org/bro/ticket/814#comment:4>
Bro Tracker <http://tracker.bro-ids.org/bro>
Bro Issue Tracker
2:05 p.m.
#814: Fix MailAlarmsTo
-----------------------------+--------------------------
Reporter: Tyler.Schoenke | Owner:
Type: Merge Request | Status: new
Priority: Normal | Milestone: Bro2.1
Component: BroControl | Version: git/master
Resolution: | Keywords: MailAlarmsTo
-----------------------------+--------------------------
Changes (by dnthayer):
* type: Problem => Merge Request
--
Ticket URL: <http://tracker.bro-ids.org/bro/ticket/814#comment:5>
Bro Tracker <http://tracker.bro-ids.org/bro>
Bro Issue Tracker
2:49 p.m.
#814: Fix MailAlarmsTo
-----------------------------+--------------------------
Reporter: Tyler.Schoenke | Owner:
Type: Merge Request | Status: new
Priority: Normal | Milestone: Bro2.1
Component: BroControl | Version: git/master
Resolution: | Keywords: MailAlarmsTo
-----------------------------+--------------------------
Comment (by Tyler.Schoenke):
Replying to [comment:3 dnthayer]:
So, the "MailAlarmsTo" would specify the
email address for the alarm
summary email, and
the "MailTo" would specify the email address
for notices with action
ACTION_EMAIL (and for
the connection summary report that is sent each time
log rotation
occurs), right?
Yes, I wanted to send Alarm Summary to MailAlarmsTo, and have ACTION_ALARM
emails go to the MailTo. We have email alerts going into a tracking
system to quarantine infected systems. We don't need the Alarm Summary
emails being sent into our tracker. Thanks for making the change!
--
Ticket URL: <http://tracker.bro-ids.org/bro/ticket/814#comment:6>
Bro Tracker <http://tracker.bro-ids.org/bro>
Bro Issue Tracker
10 Aug
10 Aug
1:33 p.m.
#814: Fix MailAlarmsTo
-----------------------------+--------------------------
Reporter: Tyler.Schoenke | Owner: robin
Type: Merge Request | Status: closed
Priority: Normal | Milestone: Bro2.1
Component: BroControl | Version: git/master
Resolution: fixed | Keywords: MailAlarmsTo
-----------------------------+--------------------------
Changes (by robin):
* owner: => robin
* status: new => closed
* resolution: => fixed
Comment:
In [7b22d9bb4beede95dde77873ceba2a49c6d19917/broctl]:
{{{
#!CommitTicketReference repository="broctl"
revision="7b22d9bb4beede95dde77873ceba2a49c6d19917"
Merge remote-tracking branch 'origin/topic/dnthayer/bug814'
* origin/topic/dnthayer/bug814:
Fix MailAlarmsTo broctl config option
Closes #814.
}}}
--
Ticket URL: <http://tracker.bro-ids.org/bro/ticket/814#comment:7>
Bro Tracker <http://tracker.bro-ids.org/bro>
Bro Issue Tracker
3608
days inactive
3716
days old
8 comments
1 participants
participants (1)
-
Bro Tracker