Tracking down where an email alert is generating from

[RaeAlexsis]

Hi All,

I am fairly new to being a sysadmin and looking after our companies Zabbix installation. Quickly learning all about it. We are running 5.2 currently.

One thing I am stuck on though is where a particular email alert is coming from. It is going to a 3rd party who used to do after hours support for us, so ideally they don't want to be getting any alerts from us

I can see the emails via mail trace in O365. It shows the emails as coming from the email we configured for zabbix (zabbixalerts@domain) and going straight to their 3rd party account. P1 alerts are going to them, but P3s are not.


Things I have looked at

• Users: Checking every accounts emails under media, and also the "Use if severity" in there checking if one matched being enabled for P1 but not P3. Its not in there.
• Action Log: I can see the basic email alert action when the P1 was triggered, but the only recipients are Admin, our helpdesk email, and a DL for alerts with some of our team in it. I checked that DL and their email address is not in there.
• A copy of the email from the 3rd party which has the helpdesk email and the alerts DL in the to box but not their email.
• Trigger Actions: Checking "Basic alert email" which triggers if the severity is greater than or equals P3, which goes to Admin, our helpdesk email, and the alerts DL. I cannot see a different action for P1s
• The trigger for "Zabbix Agent is not available" which has been the only thing to make a p1 recently (so don't know if its tied to that or P1's in general) but could not find anything there.
• Event details of the specific P1 alert. Again can only see recipients as Admin, our helpdesk email, and the alerts DL. There is an ops genie thing as well but that has not been fully set up yet. I would

I was suspecting the Alerts DL we have was the cause, that maybe the 3rd party address was in there, but I can see P3 alerts going to the same 3 targets (Zabbix Admin, our helpdesk, and the Alerts DL) and those are not ending up at the 3rd party. If one of the other members was forwarding it on I would expect to see it arriving at the 3rd party from a different email address instead of our zabbixalerts@domain one.

Can any one suggest any other places to look?

Thanks in advance

[RaeAlexsis]

After much hunting .... there was a rule set up on someones mailbox.

-facepalm-

On the plus side the hunt taught me a lot about how Zabbix generates its alerts so not a complete waste.