0

The psad monitoring tool keeps on sending lots of mail to my localhost admin account. I use my ubuntu server as a NAT router, and psad warned me to enable logging in iptables. After I did so, it sarted filling my mailbox with loads of messages. Within few days the size of mail box has grown to 3.4 GB.

How can I completely turn off mailing on psad?

1

Please see the documentation: http://cipherdyne.org/psad/docs/config.html

You could set 'EMAIL_ADDRESSES' to a blackhole address (eg a receive address that just discards what it gets), or consider tuning the following:

'EMAIL_ALERT_DANGER_LEVEL' 'PSAD_EMAIL_LIMIT' 'EMAIL_LIMIT_STATUS_MSG'

Those are described in the URL I provided above. There are further email alerts for DShield as well, if you have that enabled - if so, they are also described in that URL.

0

Under psad.conf:

### Allow reporting methods to be enabled/restricted.  This keyword can
### accept values of "nosyslog" (don't write any messages to syslog),
### "noemail" (don't send any email messages), or "ALL" (to generate both
### syslog and email messages).  "ALL" is the default.  Both "nosyslog"
### and "noemail" can be combined with a comma to disable all logging
### and alerting.
ALERTING_METHODS            ALL;

Note that changing ALTERTING_METHODS to noemail will stop all emails from psad.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.