Based on one of the comments regarding
setroubleshoot you can install this extra package like so:
$ sudo yum install -y setroubleshoot
Once installed take a look at its config file, specifically this section:
# recipients_filepath: Path name of file with email recipients. One address
# per line, optionally followed by enable flag. Comment character is #.
recipients_filepath = /var/lib/setroubleshoot/email_alert_recipients
Now go ahead and create that file referenced:
$ echo "email@example.com" > /var/lib/setroubleshoot/email_alert_recipients
Then restart/start the service:
$ sudo systemctl start setroubleshoot
setroubleshoot also provides the ability to filter the SE alerts through the email_alert_recipients file:
These filters are a bit hard to gleam from the docs but they go as follows:
Ignore After First Alert::
- This is the default. The address will receive an alert only the first time it fires. Email alerts will be filtered for the alert in
question for all subsequent firings of the alert.
- An email alert will be sent for every instance of every alert to this address.
Email alerts will never be sent for this address. One can use this to temporarily disable alerts to an address.
But I don't have a desktop session on the node I want to receive
email alerts for? For instance how can I monitor a server?
You can directly edit the file
/var/lib/setroubleshoot/email_alert_recipients. This is the file the
above GUI is modifying. The format of the file is line based, the hash
(#) character is the comment character, the comment extends to the end
of the line, blank lines are ignored.
NOTE: Addresses are one per line, optionally following the address
(separated by whitespace) are options in the form name=value.
Currently there is only one option:
I heavily edited the above snippet, but tried to keep the "spirit" of this section from the FAQ.