Description

Reports configured to be distributed through email are generated successfully, but are not received by the recipients.

Symptoms

Message seen in /var/log/qradar.log :

Jan 5 06:06:31 ::ffff:10.x.x.x [report_runner] [main] com.q1labs.frameworks.exceptions.FrameworksException: Unable to send email to: [[email protected]], the attachment size is too large. You can update the Max Email Attachment Size (KB) in the System Settings.

Solution

The reports being generated are larger than the maximum email attachment size configured in System Settings . Typically, the default is configured for 15,360 Kilobytes (KB)

Increase the email attachment size:

  1. Login to the JSA user interface.

  2. Click the Admin tab.

  3. Click the System Settings icon.

  4. Scroll down to Switch to: and click Advanced.

  5. Under System Settings, find Max Email Attachment Size (KB).

  6. Modify the Max Email Attachment Size according to your organizational needs.

Modification History

2019-07-15: Corrected typo.