Email (SMTP)

A SMTP action sends event log messages via email and lets you choose between three different formats:

This value will appear as the sender name of the email (not the email address). This is usually the hostname of the computer. If you plan on replicating a SMTP action to multiple hosts then you can use the $HOSTNAME variable here. To learn more about variables click here.

The email address under which this email will be sent. If you are notifying people other than yourself then you should probably make sure that replies to emails sent from EventSentry arrive somewhere.

A comma-separated list of the recipient's email addresses. The total length of all recipients (including the commas) can not exceed 512 characters. If any of the email addresses are rejected by the server then the email will not be sent and an error will be logged to the event log.

You can click the mobile phone icon next to the recipients field if you intend to send a text message to a mobile phone through an email gateway. Most mobile phone providers offer such gateways free of charge to the sender, even though standard text messaging rates usually apply to the recipient. The helper dialog creates the correct email address for you, if your provider is not listed then you will need to contact your provider to obtain the correct email address.

Please feel free to suggest additional mobile phone providers to our support team for inclusion in a future version of EventSentry.

As stated in the dialog, it is highly recommend that you apply threshold to any action that sends messages to a mobile / cell phone where per-message charges might apply.

The subject of the email. The variables $LOG and $COUNT are supported. To learn more about variables click here.

The host name or IP address of the SMTP server and the port on which the specified SMTP server listens for incoming requests. The port is set to 25 by default.

You can specify a secondary SMTP server (including port and authentication information) that will be contacted if the primary SMTP server is unavailable. EventSentry will always connect to the primary SMTP server before it will try the secondary SMTP server.

If your SMTP server requires authentication then specify username and password here. You can specify a username and password for both the primary and the secondary server.

Currently the clear text (AUTH LOGIN) and MD5 (CRAM MD-5) authentication protocols are supported.

Check this box if the server that you are connecting to supports or requires a SSL/TLS connection. If you check this box, then EventSentry will only connect to the specified server using a SSL/TLS connection.

You can receive emails either as plain ASCII text, as HTML or in miniature size.

(X)HTML Email: Check this box if you would like to receive emails in (X)HTML format. This is usually much more appealing to the eye but emails will be bigger due to the HTML tag overhead. When using the HTML option you can also configure the font and size used in the HTML emails, the default is Verdana at 11px. Emails sent in HTML format also include a plain text for non-html capable email clients.

You can customize the look and feel of emails by choosing the font and size used in HTML emails, by selecting which event properties should be included in the email, or be minimizing the amount of text that is displayed in the email altogether.

Emails will be sent in plain ASCII text. Clicking the Customize button will allow you to pick which fields from an event are included in the email. For example, you can customize the output to never show the event number or never show the event category for example.

Use the HTML Font Options to customize the font and font size of emails generated by EventSentry. As with the ASCII style, clicking the Customize button will allow you to pick which fields from an event are included in the email.

If you plan on being notified on a cellphone or pager then you should check this box. It sends small emails that contain only the most important information. You can customize the look of "Miniature" email by clicking the "Customize" button. The option Max. number of events per email might be of interested as well.

You can customize which event log properties (e.g. log, source, category, etc.) will be included in emails sent by EventSentry. By default, all properties with the exception of the "Filter Notes" will be included.

For HTML-styled emails you can select both the font and the size used in emails.

Checking the "Include EventSentry Version" check box will show the current version of the EventSentry agent in the email. This is an easy and unobtrusive way to verify that the agent on a given machine is running the latest version.

You can optionally add a header and/or footer to every outgoing email using this notification. This feature is especially useful for service providers who wish to add additional information to emails sent to their customers. Both the header and footer may contain up to 1024 characters, with a maximum of 2048 after variable expansion.

Most email clients support importance flags that indicate the importance of an email. This feature is useful to immediately determine if an email sent by EventSentry is important or not.

	High Importance:	Emails will be sent with the high importance flag if at least one event log entry in the email is either an error or an audit failure.
	Low Importance:	Emails will be sent with the low importance flag if an email contains only information or audit success messages.

Used in combination with the High and Low Importance flags. When Flag Literal is checked, an email will always be sent with either a high or low importance, regardless of the email content.

By default EventSentry would include as many event records as scanned in an email (an email could contain 5+ event records if those occurred in a short amount of time). This option is particularly useful for cell phones where event records after the first one cannot be read. Set this option to unlimited to restore the default behaviour, otherwise to the maximum number of event records each email should contain.

You can select an existing RAS (including VPN) connection, and EventSentry will dial this connection prior to sending the email, if the SMTP server could not be contacted. The RAS connection will be hung up after sending the emails if the "Hangup After" option is checked.

You can paste the basic event properties from an email directly into the General Filter dialog to easily create an include/exclude filter based on an email you received.

Simple select the event in the email and copy it to the clipboard. Then, create a filter (or open an existing filter), click on any text field and press CTRL+V. The keyboard combination is necessary, a right-click & paste will not work. Click here for more information.