Question & Answer
Question
Why are emails not sent even though the email configuration is right and the test connection is successful?
Answer
In some cases, it is observed that email relay settings are correct and the test connection is also successful, but QRadar is still not able to send emails.
The following error can be seen in /var/log/maillog file, which indicates that the email delivery failed as the client does not have permissions to send as this sender:
Jun 15 09:03:49 Qradarhostname postfix/qmgr[4720]: 7EEDEC004EA: from=<QRADAR@localhost.localdomain>, size=24378, nrcpt=1 (queue active)
Jun 15 09:03:55 Qradarhostname postfix/smtp[120821]: 7EEZDE4EA: to=<abc@xyz.com>, relay=mail.xyz.com[XX.XX.XX.XX]:25, delay=5.6, delays=0.06/0.27/5.2/0.01, dsn=5.7.60, status=bounced (host mail.xyz.com[XX.XX.XX.XX] said: 550 5.7.60 SMTP; Client does not have permissions to send as this sender (in reply to end of DATA command))
Jun 15 09:03:55 Qradarhostname postfix/cleanup[120819]: 3A456C005CE: message-id=<20230605020355.3A456C005CE@Qradarhostname.xyz.com>
Jun 15 09:03:55 Qradarhostname postfix/bounce[121069]: 7EEZDE4EA: sender non-delivery notification: 3A456C005CE
These errors are caused due to an incorrect value in the Alert Email From Address under Admin => System Settings.
To resolve these errors, perform following steps:
- On the QRadar GUI, go to Admin tab => System Settings => Alert Email From Address
- Correct the setting to reflect the email address that has permission to send emails (check with your email server's administrator for the correct email address)
[{"Type":"MASTER","Line of Business":{"code":"LOB24","label":"Security Software"},"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Product":{"code":"SSBQAC","label":"IBM Security QRadar SIEM"},"ARM Category":[{"code":"a8m0z000000cwtKAAQ","label":"QRadar Risk and Vulnerability Manager"}],"ARM Case Number":"","Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"All Versions"}]
Was this topic helpful?
Document Information
Modified date:
18 December 2023
UID
ibm17090394