Microsoft SMTP App for Splunk
Overview
Details
Using this App:
SMTP Server log settings:
To Onborad SMTP logs, it needs to select format as “W3C Extended Log File Format“. W3C Extended format is a customizable ASCII format with a variety of different properties. You can log properties important to you, whereas you can limit log size by omitting unwanted property fields. Properties are separated by spaces. Time is recorded as UTC.
Go to link for enabling SMTP server logging http://avotrix.com/docs/How%20to%20enable%20logging%20for%20IIS%20Server%20by%20Avotrix.pdf
App configuration Setup:
Please see Splunk's official documentation for the initial installation of the app. To use the dashboards, data must have been imported using the UF from data server also configure timezone in props.conf indexer.
Links for eventtypes and macros used in app for modularity:
/manager/SMTP_IIS_Add-on_For_Splunk/saved/eventtypes
/manager/SMTP_IIS_Add-on_For_Splunk/admin/macros
Link to lookup used for showing error code details in smtp logs:
/manager/SMTP_IIS_Add-on_For_Splunk/data/lookup-table-files
Dashboard:
On the dashboard tab, you can use a time range to filter a result as per need. Selecting a new option in this panel will automatically reload all the graphs.
The very first row gives overview of daily count of Total, Outbound, Bounced and Erroneous with a trend line. Also provided drilldwon in these panels.
Outbound Email drilldown gives us details of mail sent to some recipient with other than permitted domain.
Bounced Email drilldown gives us details of delivery failure.
Error code generated while mail transaction will get captured with issue details. Drilldown for error code time will give insights of failed mail.
Error code statistics gives statistical data for all generated error codes.
Reports - Existing schedule and triggering condition can be altered as per required
Daily report to collect Error code generated: This report runs daily on 00:00 AM and collects all the error code with details
Daily report to collect Outbound Email list: This report runs daily on 00:00 AM and collects details of all outbound email sent
Daily report to collect Bounced Email list: This report runs daily on 00:00 AM and collects details of all Bounced email
Alerts - Existing schedule and triggering condition can be altered as per required
Error code generated -Email failed: Triggers when Error code count is greater than 20, runs at every three hours
Outbound Email sent: Triggers when an outbound email sent is greater than 0, runs at every hour past 15 minutes
Bounced Email alert generated: Triggers when Bounced email count is greater than 20, runs at every three hours
Contact US
Email: support@avotrix.com