IBM Support

QRadar: Email queue fills up from rule response

Troubleshooting


Problem

Checking and cleaning postfix mail queue, if emails have not been sent

Symptom

Emails being sent by rules or alerts might back up in the Postfix mail queue, if a system mis-configuration causes them to be undeliverable or a bad rule causes many emails to be generated. This can cause a high number of emails to be queued. This email volume, if not stopped at QRadar, might overwhelm a mail server.

Cause

Incorrect system configuration or misconfigured rule

Diagnosing The Problem

To confirm the Postfix that the mail queue is backed up, one of the following commands can be run from the command line while logged in as root:

  • mailq

    32CF02FE0E39 2173 Fri Dec 15 01:37:21 QRADAR@localhost.localdomain

    (delivery temporarily suspended: connect to mail.example.com[192.168.130.233]:25: Connection refused)

    no.one@example.com

    10086 Kbytes in 3601 Requests.
  • postqueue -p

    32CF02FE0E39 2173 Fri Dec 15 01:37:21 QRADAR@localhost.localdomain

    (delivery temporarily suspended: connect to mail.example.com[192.168.130.233]:25: Connection refused)

    no.one@example.com

    10086 Kbytes in 3601 Requests.


Either of the commands show the sender, recipient, and ID of all messages queued in the Postfix system.

The commands can also be piped to less or redirected to a text file for easier reading and searching.

The ID can be used with the following command to view the actual message for a given queued mail:

  • postcat -vq ID

Again, the above can also be redirected to a file to better read the mail.

Resolving The Problem

To delete all the messages in the queue, run one of the following commands:

  • postsuper -d ALL
  • postsuper -d ALL deferred

The 'deferred' option deletes messages that are marked for retry later. Depending on the scenario, both of the commands may need to be run to completely empty the queue.

If it is preferred to attempt to process (send/resend) the messages in the queue instead of deleting them, use one of the following commands:

  • postqueue -f
  • postfix flush


Where do you find more information?




[{"Product":{"code":"SSBQAC","label":"IBM Security QRadar SIEM"},"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Component":"Rules","Platform":[{"code":"PF016","label":"Linux"}],"Version":"Version Independent","Edition":"","Line of Business":{"code":"LOB24","label":"Security Software"}}]

Document Information

Modified date:
16 June 2018

UID

swg21984462