[Xymon] SMTP checks

[Jeremy Laidman]

Ian

[disclaimer: I don't use the smtp check]

I'm wondering if the "connect timeout" relates not to the TCP connection
but the SMTP conversation. I would do a packet capture during the
interaction between xymonnet and the mail server, and see if it closely
matches your telnet interaction, or deviates.

The smtp check is defined in protocols.cfg

[smtp]
   send "mail\r\nquit\r\n"
   expect "220"
   options banner
   port 25

This expects a 220 in the response after the mail\r\nquit\r\n is sent:

'*It will then expect a response beginning with "220".*' (my emphasis on
the word "then")

Your interaction shows 221 instead of 220, after the mail/quit strings. But
if this is the problem, then protocols.cfg has been wrong for many, many
years. I suspect (contrary to what I infer from the man page) that "expect"
looks in the strings for the whole interaction, not just the ones after the
"send" string is sent. In which case, the protocols.cfg entry for smtp
should work fine.

However, you might like to test removing the "expect" or altering to look
for 221 instead of 220.

Cheers
Jeremy


On Wed, 29 Sept 2021 at 00:22, Ian Diddams via Xymon <xymon at xymon.com>
wrote:

>
>
>
> ---------- Forwarded message ----------
> From: Ian Diddams <didds3 at yahoo.co.uk>
> To: xymon <xymon at xymon.com>
> Cc:
> Bcc:
> Date: Tue, 28 Sep 2021 13:52:12 +0000 (UTC)
> Subject: SMTP checks
> xymon server 4.3.28, centos 7.9
> mail server centos 6 (about to be replaced anyway)
>
> I'm in a bit of a quandary...
>
> we have an smtp check of a server ("oscar").
>
> Literally for "years" (3+) the xymon in house smtp check has been more
> than happy.
>
> Then since Sept 11th [1] its been flipping constantly beyween green and
> happy to red
> eg
>
> Service listening but unavailable (connect timeout)
>
>
> Seconds: 0.001842000
>
>
> But if I run a telnet test from the xymon server itself it always connects
> immediately, and responds instantaneously.
>
> eg
>
> $ telnet oscar 25
> Trying <redacted>...
> Connected to oscar.
> Escape character is '^]'.
> 220 a.b.co.uk ESMTP Postfix
> mail
> 501 5.5.4 Syntax: MAIL FROM:<address>
> quit
> 221 2.0.0 Bye
> Connection closed by foreign host.
> $
>
>
>
> All xymon logs show are emails being sent because of the alerts, ad
> falling statuses that are a result of the constant flipping from red to
> green. maillog has nothing untoward, ditto messages.
>
> Anyone any ideas what on earth is suddenly occurring that may explain this
> recent timeout issue?  any expereince of similar?
>
> didds
>
>
>
> [1] no changes made around that time etc.  Networks confirm nothing shoing
> in their logs etc.
>
>
>
> ---------- Forwarded message ----------
> From: Ian Diddams via Xymon <xymon at xymon.com>
> To: xymon <xymon at xymon.com>
> Cc:
> Bcc:
> Date: Tue, 28 Sep 2021 13:52:12 +0000 (UTC)
> Subject: [Xymon] SMTP checks
> _______________________________________________
> Xymon mailing list
> Xymon at xymon.com
> http://lists.xymon.com/mailman/listinfo/xymon
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.xymon.com/pipermail/xymon/attachments/20210929/2a973a17/attachment.htm>