CPUG: The Check Point User Group

Resources for the Check Point Community, by the Check Point Community.


Tim Hall has done it again! He has just released the 2nd edition of "Max Power".
Rather than get into details here, I urge you to check out this announcement post.
It's a massive upgrade, and well worth checking out. -E

 

Results 1 to 9 of 9

Thread: SmartView Monitor email alerts

  1. #1
    Join Date
    2009-12-11
    Posts
    24
    Rep Power
    0

    Default SmartView Monitor email alerts

    All,

    I am stumped as how to get the email alerts working with SmartView Monitor. I have configured my smartDashboard, Global Properties>Log and Alert>Alerts. Under Alert Commands I have a checkbox in Run mail alert script and in that script I have 'internal_sendmail -s alert -t mailserver -f fwgroup@123.com user1@123.com'. I also have setup a UserDefined script using 'sendmail -s alert -t mailserver -f fwgroup@123.com user1@123.com'. I have configured the global threshold settings to mail and useralert to test on Firewall Policy install time to test both scripts. I do not get an alert from either of them. I do see the alert pop up on the Smartview Monitor. Also I have tried running '/opt/CPsuite-R77/fw1/bin/sendmail -s alert -t mailsserver -f fwgroup@123.com user1@123.com < test.txt' When I run that from the management station I do receive an email from that. Am I missing anything else?

    Thanks in advance,

    Bill

  2. #2
    Join Date
    2006-03-08
    Location
    Lausanne
    Posts
    1,030
    Rep Power
    15

    Default Re: SmartView Monitor email alerts

    Quote Originally Posted by bingdude View Post
    All,

    I am stumped as how to get the email alerts working with SmartView Monitor. I have configured my smartDashboard, Global Properties>Log and Alert>Alerts. Under Alert Commands I have a checkbox in Run mail alert script and in that script I have 'internal_sendmail -s alert -t mailserver -f fwgroup@123.com user1@123.com'. I also have setup a UserDefined script using 'sendmail -s alert -t mailserver -f fwgroup@123.com user1@123.com'. I have configured the global threshold settings to mail and useralert to test on Firewall Policy install time to test both scripts. I do not get an alert from either of them. I do see the alert pop up on the Smartview Monitor. Also I have tried running '/opt/CPsuite-R77/fw1/bin/sendmail -s alert -t mailsserver -f fwgroup@123.com user1@123.com < test.txt' When I run that from the management station I do receive an email from that. Am I missing anything else?

    Thanks in advance,

    Bill
    It is a syntax issue. try running the command on the box as defined in the GUI. I bet "internal_sendmail" command is not recognised.
    -------------

    Valeri Loukine
    CCMA, CCSM, CCSI
    http://checkpoint-master-architect.blogspot.com/

  3. #3
    Join Date
    2009-12-11
    Posts
    24
    Rep Power
    0

    Default Re: SmartView Monitor email alerts

    Thanks Valeri.

    I tried the internal_sendmail and it did not work. I updated the script to use 'sendmail -s alert -t mailserver -f fwgroup@123.com user1@123.com' instead and it still isn't working. I also did a tcpdump to see if an email got sent out of the management station. I did not see any attempt/traffic from the management station.

  4. #4
    Join Date
    2012-08-16
    Posts
    182
    Rep Power
    8

    Default Re: SmartView Monitor email alerts

    You can try this also, $FWDIR/bin/sendmail -s 'subject' -t 1.2.3.4 -f from@from.com to@to.com

  5. #5
    Join Date
    2006-03-08
    Location
    Lausanne
    Posts
    1,030
    Rep Power
    15

    Default Re: SmartView Monitor email alerts

    Quote Originally Posted by aweldon View Post
    You can try this also, $FWDIR/bin/sendmail -s 'subject' -t 1.2.3.4 -f from@from.com to@to.com
    Second that, the path was missing.

    Alternatively one could copy sendmail to more common location such as /bin/
    -------------

    Valeri Loukine
    CCMA, CCSM, CCSI
    http://checkpoint-master-architect.blogspot.com/

  6. #6
    Join Date
    2009-12-11
    Posts
    24
    Rep Power
    0

    Default Re: SmartView Monitor email alerts

    I did changed it to use '$FWDIR/bin/sendmail -s 'subject' -t 1.2.3.4 -f from@from.com to@to.com' and now I see it the message being sent on the tcpdump side, but yet I am not receiving any messages still. When I run the following from cli I receive an email. I still get a message if I leave out the 'this is a test.' part. Wonder if my mail server is now dropping the message for some reason.

    '$FWDIR/bin/sendmail -s 'subject' -t 1.2.3.4 -f from@from.com to@to.com'
    this is a test.
    <Ctrl-D>

  7. #7
    Join Date
    2009-12-11
    Posts
    24
    Rep Power
    0

    Default Re: SmartView Monitor email alerts

    All is working now as advertised. Thanks for the help.

  8. #8
    Join Date
    2006-03-08
    Location
    Lausanne
    Posts
    1,030
    Rep Power
    15

    Default Re: SmartView Monitor email alerts

    Quote Originally Posted by bingdude View Post
    All is working now as advertised. Thanks for the help.
    glad to hear that
    -------------

    Valeri Loukine
    CCMA, CCSM, CCSI
    http://checkpoint-master-architect.blogspot.com/

  9. #9
    Join Date
    2015-08-26
    Posts
    86
    Rep Power
    4

    Default Re: SmartView Monitor email alerts

    Hello, Is there any way to format these emails? This is all gibberish to the customer. No xml? no text files to send only the fields we want to see? Any documentation on what all these fields are?

    HeaderDateHour: 20Mar2019 0:22:33; ContentVersion: 5; HighLevelLogKey: N/A; Uuid: {0x5c91c009,0x0,0x17000b0a,0xc0000002}; SequenceNum: 1; Action: accept; Origin: GCBFW2; IfDir: >; InterfaceName: eth2; Alert: mail; OriginSicName: CN=GCBFW2,O=PGCB-Mgmt..7dm32n; OriginSicName: CN=GCBFW2,O=PGCB-Mgmt..7dm32n; HighLevelLogKey: 18446744073709551615; inzone: Internal; outzone: Local; service_id: ssh; src: V84af7e3e-e52f-4e45-8b5e-ce3a21a5d21e; dst: GCBFW2; proto: tcp; xlatesrc: ; xlatedst: ; NAT_rulenum: 107; NAT_addtnl_rulenum: 1; security_inzone: Interface_inside; security_outzone: ; UP_match_table: TABLE_START; ROW_START: 0; match_id: 2; layer_uuid: 272f1cae-8179-4bb4-b5e6-e46943b12057; layer_name: Hbg_5600_Cluster Network; rule_uid: 379515d1-7b4f-42f9-99f3-3ec0fba782d1; rule_name: SSH Access to GW's or SMS will generate an email.; action: 2; parent_rule: 0; ROW_END: 0; UP_match_table: TABLE_END; UP_alert_table: TABLE_START; ROW_START: 0; alert: mail; ROW_END: 0; UP_alert_table: TABLE_END; ProductName: VPN-1 & FireWall-1; svc: ssh; sport_svc: 57388; xlatedport_svc: ; xlatesport_svc: ; ProductFamily: Network;

Similar Threads

  1. Trouble configuring SmartView Monitor For E-mail alerts
    By Maybedave in forum SmartView Monitor
    Replies: 1
    Last Post: 2013-05-10, 14:12
  2. Email alerts
    By sachden in forum IPS Blade (Formerly SmartDefense)
    Replies: 1
    Last Post: 2008-06-30, 09:32
  3. email alerts - how?
    By goldie in forum SmartView Monitor
    Replies: 2
    Last Post: 2007-06-07, 10:11
  4. Email alert for server status at SmartView monitor
    By cheungtony in forum SmartView Monitor
    Replies: 3
    Last Post: 2007-03-15, 09:42
  5. Alerts via email
    By 1q2w3e in forum Check Point SecurePlatform (SPLAT)
    Replies: 1
    Last Post: 2006-10-19, 02:36

Tags for this Thread

Bookmarks

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •