IBM Support

QRadar: Reports are generating but fail to send through email

Troubleshooting


Problem

Reports configured to be distributed through email are being generated successfully, but are not received by the recipients.

Symptom

You may see in /var/log/qradar.log messages similar to:

Jan 5 06:06:31 ::ffff:10.x.x.x [report_runner] [main] com.q1labs.frameworks.exceptions.FrameworksException: Unable to send email to: [example_supervisor@example.com], the attachment size is too large. You can update the Max Email Attachment Size (KB) in the System Settings.

Cause

The reports being generated are larger than the maximum email attachment size configured in System Settings. Typically the default is configured for 15,360 Kilobytes (KB)

Resolving The Problem

This can be increased through the following procedure:

  1. Log in to the QRadar User Interface.
  2. Click the Admin tab.
  3. Click System Settings icon.
  4. Scroll down to Switch to: and click Advanced.

  5. Under System Settings find Max Email Attachment Size (KB).


  6. Modify the Max Email Attachment Size according to your organizational needs.

Where do you find more information?

[{"Product":{"code":"SSBQAC","label":"IBM Security QRadar SIEM"},"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Component":"Reports","Platform":[{"code":"PF016","label":"Linux"}],"Version":"Version Independent","Edition":"","Line of Business":{"code":"LOB24","label":"Security Software"}}]

Document Information

Modified date:
16 June 2018

UID

swg21997483

Page Feedback