Sart's questions

Task is the following: There is a mail server in a secure zone with no access to Internet and/or other networks. I need to relay contents of one of the mailboxes to Amazon SES for delivery. I set up Fetchmail to grab mails from the said server. I set up Postfix to relay mail to AWS.

Fetchmail ingests the mails. If I try to send out a test mail with Postfix - it works fine. But it doesn't send out mails that are downloaded by Fetchmail.

Fetchmail config:

set daemon 300
set logfile /var/log/fetchmail
set postmaster root

set no bouncemail

defaults:
timeout 300
antispam -1
batchlimit 100

poll imap.example.com
  protocol IMAP
  port 993
  user "[email protected]" there is mailer here
  password p@$$W0RD
  nofetchall keep ssl
  smtpaddress localhost

Postfix config:

smtpd_banner = $myhostname ESMTP $mail_name (Ubuntu)
biff = no
append_dot_mydomain = no
readme_directory = no
compatibility_level = 2
smtpd_tls_cert_file=/etc/ssl/certs/ssl-cert-snakeoil.pem
smtpd_tls_key_file=/etc/ssl/private/ssl-cert-snakeoil.key
smtpd_tls_security_level=may

smtp_tls_CApath=/etc/ssl/certs
smtp_tls_security_level=may
smtp_tls_session_cache_database = btree:${data_directory}/smtp_scache

smtpd_relay_restrictions = permit_mynetworks permit_sasl_authenticated defer_unauth_destination
myhostname = gateway.example.com
mydomain = example.com
alias_maps = hash:/etc/aliases
alias_database = hash:/etc/aliases
myorigin = $mydomain
mydestination = gateway.example.com, $myhostname, localhost.localdomain, localhost
relayhost = [email-smtp.eu-central-1.amazonaws.com]:587
relay_domains = $mydomain
mynetworks = 127.0.0.0/8 [::ffff:127.0.0.0]/104 [::1]/128 10.0.0.0/8
mailbox_size_limit = 0
recipient_delimiter = +
inet_interfaces = all
inet_protocols = all
smtp_sasl_auth_enable = yes
smtp_sasl_password_maps = hash:/etc/postfix/sasl/ses
smtp_sasl_security_options = noanonymous
smtp_use_tls = yes
smtp_tls_note_starttls_offer = yes
smtp_tls_CAfile = /etc/ssl/certs/ca-certificates.crt

I am trying to make Logstash to alert me only after it receives over 1000 items within 10 minutes. I need alerts in both Hipchat and PagerDuty.

My config seems reasonable, but does not work as expected.

filter {
    if my_filtering_conditional_that_is_100%_correct {
        throttle {
            before_count => 1000
            period => 600
            add_tag => ["PD"]
            key => "string"
        }
        clone {
            add_tag => ["Count"]
        }
    }
    if "Count" in [tags] {
        throttle {
            before_count => 1000
            period => 600
            add_tag => ["HC"]
            key => "string"
        }
    }
}

output {
    if "PD" in [tags] {
         pagerduty {
            event_type => trigger
            incident_key => "logstash/Logstash"
            service_key => Pagerduty_API_key
            workers => 1
            description => "Alert message"
        }
    }
    if "HC" in [tags] {
        hipchat {
            color => "random"
            from => "Logstash"
            format => "Alert message"
            room_id => "Room"
            token => "token"
        }
    }
}