<p dir="ltr">It looks to me like the emails coming from Splunk are malformed. The Postfix log shows that they're not getting a Message-ID header (which may not be important). The RT errors suggest to me that they don't have a valid From address.</p>
<div class="gmail_quote">On 03/07/2014 1:07 am, "john bradley" <<a href="mailto:jbradley.mail@gmail.com">jbradley.mail@gmail.com</a>> wrote:<br type="attribution"><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div dir="ltr"><div><div>enabled logging:<br>Set($LogToFile, 'debug');<br>Set($LogDir, '/var/log');<br>Set($LogToFileNamed, "rt.log");<br>#log to rt.log<br><br>[19480] [Wed Jul 2 13:25:40 2014] [debug]: Converting 'utf-8' to 'utf-8' for text/plain - Subjectless message (/opt/rt4/sbin/../lib/RT/I18N.pm:244)<br>
[19480] [Wed Jul 2 13:25:40 2014] [debug]: Encode::Guess guessed encoding: ascii (/opt/rt4/sbin/../lib/RT/I18N.pm:498)<br>[19480] [Wed Jul 2 13:25:40 2014] [debug]: Encode::Guess guessed encoding: ascii (/opt/rt4/sbin/../lib/RT/I18N.pm:498)<br>
[19480] [Wed Jul 2 13:25:40 2014] [error]: Unable to parse an email address from splunk: Couldn't find row (/opt/rt4/sbin/../lib/RT/EmailParser.pm:543)<br>[19480] [Wed Jul 2 13:25:40 2014] [error]: Unable to parse an email address from splunk: Couldn't find row (/opt/rt4/sbin/../lib/RT/EmailParser.pm:543)<br>
[19480] [Wed Jul 2 13:25:40 2014] [error]: Unable to parse an email address from splunk: Couldn't find row (/opt/rt4/sbin/../lib/RT/EmailParser.pm:543)<br>[19480] [Wed Jul 2 13:25:40 2014] [error]: Unable to parse an email address from splunk: Couldn't find row (/opt/rt4/sbin/../lib/RT/EmailParser.pm:543)<br>
[19480] [Wed Jul 2 13:25:40 2014] [warning]: Failed to parse From: splunk (/opt/rt4/sbin/../lib/RT/Interface/Email/Auth/MailFrom.pm:70)<br>[19480] [Wed Jul 2 13:25:40 2014] [error]: Couldn't parse or find sender's address (/opt/rt4/sbin/../lib/RT/Interface/Email/Auth/MailFrom.pm:74)<br>
[19480] [Wed Jul 2 13:25:40 2014] [error]: Could not record email: Could not load a valid user (/opt/rt4/share/html/REST/1.0/NoAuth/mail-gateway:75)<br><br></div><div>Checked that rtir user exists in RT to create tickets<br>
</div><div><br></div>Added:<br>Set($AutoCreate, {Privileged => 0});<br><br></div><div>Also tried with:<br>Set($AutoCreate, {Privileged => 1});<br><br>rtir: "|/opt/rt4/bin/rt-mailgate --no-verify-ssl --queue 'Incident Reports' --action correspond --url <a href="https://rtir.vtitel.net/" target="_blank">https://rtir.vtitel.net/</a>"<br>
<br>#newaliases <br></div><div><div>#service postfix restart<br><br>Still receiving the same error. Thanks for the help so far tracking this down.<br><div><div class="gmail_extra"><br><div class="gmail_quote">On Tue, Jul 1, 2014 at 7:36 PM, Alex Peters <span dir="ltr"><<a href="mailto:alex@peters.net" target="_blank">alex@peters.net</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><p dir="ltr">What does the RT debug log say in both instances?</p>
<div class="gmail_quote"><div><div>On 02/07/2014 8:45 am, "john bradley" <<a href="mailto:jbradley.mail@gmail.com" target="_blank">jbradley.mail@gmail.com</a>> wrote:<br type="attribution"></div>
</div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div><div>
<div dir="ltr"><div><div><div><div>RHEL 6.5<br></div>mail: postfix – running on RT server box</div>RT: 4.0.20<br></div>RTIR: latest<br><br></div>Everyone group is allowed to create tickets in the queue. Kinda stumped here - an advice would be much appreciated.<br>
<div><br>
<p class="MsoNormal">From maillog</p>
<p class="MsoNormal"><br></p><p class="MsoNormal">Doesn't work</p><p class="MsoNormal">#############<br>
Jul 1 18:13:50 myRTserver postfix/smtpd[13562]: connect from <a href="http://splunk.mydomain.net" target="_blank">splunk.mydomain.net</a>[10.xxx.xxx.xxx]<br>
Jul 1 18:13:50 myRTserver postfix/smtpd[13562]: 35CBC2006B: client=<a href="http://splunk.mydomain.net" target="_blank">splunk.mydomain.net</a>[10.xxx.xxx.xxx]<br>
Jul 1 18:13:50 myRTserver postfix/cleanup[13565]: 35CBC2006B:
message-id=<><br>
Jul 1 18:13:50 myRTserver postfix/qmgr[12896]: 35CBC2006B:
from=<<a href="mailto:splunk@Splunk.myRTserverDomain.net" target="_blank">splunk@Splunk.myRTserverDomain.net</a>>, size=5744, nrcpt=1 (queue
active)<br>
Jul 1 18:13:50 myRTserver postfix/smtpd[13562]: disconnect from <a href="http://splunk.mydomain.net" target="_blank">splunk.mydomain.net</a>[10.xxx.xxx.xxx]<br>
Jul 1 18:13:50 myRTserver postfix/local[13566]: 35CBC2006B:
to=<<a href="mailto:rtir@rtir.myRTServerDomain.net" target="_blank">rtir@rtir.myRTServerDomain.net</a>>, relay=local, delay=0.29,
delays=0.08/0.01/0/0.2, dsn=2.0.0, status=sent (delivered to command:
/opt/rt4/bin/rt-mailgate --no-verify-ssl --queue 'Incident Reports' --action
correspond --url <a href="https://rtir.myRTServerDomain.net/" target="_blank">https://rtir.myRTServerDomain.net/</a>)<br>
Jul 1 18:13:50 myRTserver postfix/qmgr[12896]: 35CBC2006B: removed<br>
<br>
Works</p><p class="MsoNormal">#########<br>
Jul 1 18:14:34 myRTserver postfix/pickup[13508]: D3CF02006F: uid=0
from=<root><br>
Jul 1 18:14:34 myRTserver postfix/cleanup[13565]: D3CF02006F:
message-id=<<a href="mailto:20140701221434.D3CF02006F@rtir.myRTServerDomain.net" target="_blank">20140701221434.D3CF02006F@rtir.myRTServerDomain.net</a>><br>
Jul 1 18:14:34 myRTserver postfix/qmgr[12896]: D3CF02006F:
from=<<a href="mailto:root@rtir.myRTServerDomain.net" target="_blank">root@rtir.myRTServerDomain.net</a>>, size=444, nrcpt=1 (queue active)<br>
Jul 1 18:14:35 myRTserver postfix/pickup[13508]: 2F7ED20070: uid=48
from=<apache><br>
Jul 1 18:14:35 myRTserver postfix/cleanup[13565]: 2F7ED20070:
message-id=<<a href="mailto:rt-4.0.20-12451-1404252875-1771.10-3-0@rtir.myRTServerDomain.net" target="_blank">rt-4.0.20-12451-1404252875-1771.10-3-0@rtir.myRTServerDomain.net</a>><br>
Jul 1 18:14:35 myRTserver postfix/qmgr[12896]: 2F7ED20070:
from=<<a href="mailto:apache@rtir.myRTServerDomain.net" target="_blank">apache@rtir.myRTServerDomain.net</a>>, size=1431, nrcpt=1 (queue
active)<br>
Jul 1 18:14:35 myRTserver postfix/local[13576]: 2F7ED20070:
to=<<a href="mailto:root@rtir.myRTServerDomain.net" target="_blank">root@rtir.myRTServerDomain.net</a>>, relay=local, delay=0.02,
delays=0.01/0/0/0.01, dsn=2.0.0, status=sent (delivered to mailbox)<br>
Jul 1 18:14:35 myRTserver postfix/qmgr[12896]: 2F7ED20070: removed<br>
Jul 1 18:14:35 myRTserver postfix/local[13566]: D3CF02006F:
to=<<a href="mailto:rtir@rtir.myRTServerDomain.net" target="_blank">rtir@rtir.myRTServerDomain.net</a>>, relay=local, delay=0.4,
delays=0.01/0/0/0.39, dsn=2.0.0, status=sent (delivered to command:
/opt/rt4/bin/rt-mailgate --no-verify-ssl --queue 'Incident Reports' --action
correspond --url <a href="https://rtir.myRTServerDomain.net/" target="_blank">https://rtir.myRTServerDomain.net/</a>)<br>
Jul 1 18:14:35 myRTserver postfix/qmgr[12896]: D3CF02006F: removed</p><p class="MsoNormal"><br></p><p class="MsoNormal">postfix config<br></p><p class="MsoNormal"># RECEIVING MAIL</p><p class="MsoNormal">inet_interfaces = all</p>
<p class="MsoNormal">mynetworks = <a href="http://127.0.0.0/8" target="_blank">127.0.0.0/8</a>, <a href="http://10.0.0.0/8" target="_blank">10.0.0.0/8</a></p><p class="MsoNormal"><br></p>
Thanks!<br></div></div>
<br></div></div><span><font color="#888888">--<br>
RT Training - Boston, September 9-10<br>
<a href="http://bestpractical.com/training" target="_blank">http://bestpractical.com/training</a><br></font></span></blockquote></div>
</blockquote></div><br></div></div></div></div></div>
</blockquote></div>