Send an Email When an Event Occurs

Prerequisites

Know which event you want: Choose What to Log

This channel sends one mail every time the event occurs. That suits an event a person has to act on, such as a release request waiting for approval or a failed backup, and does not suit anything that happens more than a few times a day.

This is not the notification system your end users see. Quarantine digests, banners, and release notifications are templates, configured under Notifications Overview.

Configure the appender

In the Expert Editor, go to the directory of the container that emits your event, listed in How Logging Works.
Open logback-audit.xml, or create it if it does not exist yet.

Add the appender and the logger. The mail is relayed differently depending on which component sends it, so pick the tab that matches your event’s container:

MTA (Core container)
XCC (Backend container)

Relays through the local MTA on its internal port, so no TLS is involved.

activeguard/core/logback-audit.xml

<?xml version="1.0" encoding="UTF-8"?>
<included>
    <!-- Set to your xorlab domain -->
    <property name="host.name" value="xyz.activeguard.cloud"/>

    <appender name="smtpMailAppender" class="ch.qos.logback.classic.net.SMTPAppender">
        <from>no-reply@${host.name}</from>
        <to>example@xorlab.com</to>
        <subject>Email reported via ${host.name}</subject>

        <layout class="ch.qos.logback.classic.PatternLayout">
            <pattern>An email was reported\nDate: %d{yyyy-MM-dd HH:mm}\nLink https://${host.name}/messages/all/message/%X{gr.id} \n%jsonMsg\n</pattern>
        </layout>

        <smtpHost>mta.activeguard.xor</smtpHost>
        <smtpPort>10026</smtpPort>
        <evaluator class="com.xorlab.sgappliance.shared.logback.evaluator.LevelEvaluator"/>
    </appender>

    <!-- Change the name to the event you chose -->
    <logger name="trace.msg_analysis.complete.reported">
        <appender-ref ref="smtpMailAppender"/>
    </logger>

</included>

Submits to the xorlab MTAs over SMTP, so it needs your public MX name and STARTTLS.

TLS limitationThis configuration requires that smtpd_tls_req_ccert = no is set inside activeguard/mta/startup_cfg/postfix_custom/main.cf.

xcc/backend/logback-audit.xml

<?xml version="1.0" encoding="UTF-8"?>
<included>
    <!-- Set to your xorlab domain -->
    <property name="host.name" value="xyz.activeguard.cloud"/>

    <appender name="smtpMailAppender" class="ch.qos.logback.classic.net.SMTPAppender">
        <from>no-reply@${host.name}</from>
        <to>example@xorlab.com</to>
        <subject>Email Release Request ${host.name}</subject>

        <layout class="ch.qos.logback.classic.PatternLayout">
        <!-- feel free to change the email content here -->
        <pattern>An email was requested for release\nDate: %d{yyyy-MM-dd HH:mm}\nLink: https://${host.name}/messages/all/message/%logArg{ggrid} \n\n</pattern>
        </layout>

        <!-- Set to the MX record that resolves to the xorlab MTAs -->
        <smtpHost>mx.xyz.activeguard.cloud</smtpHost>
        <smtpPort>25</smtpPort>
        <STARTTLS>true</STARTTLS>
        <evaluator class="com.xorlab.sgappliance.shared.logback.evaluator.LevelEvaluator"/>
    </appender>

    <!-- Change the name to the event you chose -->
    <logger name="audit.quarantine.release.request.created">
        <appender-ref ref="smtpMailAppender"/>
    </logger>

</included>

Set host.name to the domain of your xorlab, and smtpHost accordingly.
Set to, subject and pattern to the recipient and the message body you want. %d is the timestamp, %jsonMsg the whole event, and %logArg{key} a single field from it. The full list is in Format Converters.
Set logger name to the event you chose.
Click Publish. The logging configuration becomes active within about one minute.
Trigger the event once and confirm the mail arrives: Verify and Troubleshoot Logging.

Attach this appender only to an event you know is rare. A logger name that is a prefix, audit rather than audit.quarantine.release.request.created, turns every analyst click into an email.

Common use: approve release requests by mail

The Backend example above logs audit.quarantine.release.request.created, which is the event behind the Self-Service Quarantine release workflow. The approver gets a mail with a direct link to the message instead of having to watch a queue in XCC. See Enable Release Requests for the rest of that setup.

​Configure the appender

​Common use: approve release requests by mail

Configure the appender

Common use: approve release requests by mail