Determine why Alert Emails are Delayed

Products

• Carbon Black EDR

Issue/Introduction

The alert emails are not reaching the intended users and EDR needs to be checked to be sure they are getting sent.

Environment

• Carbon Black EDR Servers:  Version 6.5.x and Higher

Resolution

1. Note the alert's timestamp in the WebUI
2. Check the Primary nodes postfix service is running:

   systemctl is-active postfix 
   or 
   sudo /etc/init.d/postfix status

3. Confirm the PID matches /var/lib/postfix/master.lock contents.

   grep -eaf | grep postfix
   Expect:   '/usr/libexec/postfix/master -w'

4. Check the queue: 

   cd /var/spool/postfix

5. Check the Primary node logs: 

   tail -f /var/log/mail.log

6. Validate the /etc/postfix configurations have not changed
7. If still unable to validate, open a Support case for further assistance.