This will guide you through setting Pandora to use an on-premise email server. If you’d like to use gmail as your relay, then follow Pandora’s setup here.

Install postfix:

apt-get install postfix

In the configuration process, I set mine to “Satellite Server” and set the FQDN of pandora to pf1.hlmn.co.

Next, I edited the pandora_server.conf (located in /etc/pandora/) to reflect the below:

mta_address localhost 
#mta_port 25
#mta_user myuser@mydomain.com
#mta_pass mypassword
#mta_auth LOGIN
mta_from PandoraFMS <pandora@pf1.hlmn.co>

If you skip the mta_from option, your mail may get rejected by your local mail server since it wants a FQDN email address.

Restart Pandora and you should be good to go.

service pandora_server restart

You can test your settings by going to one of your agents that has an email alert setup and manually fire the alert.

If you haven’t configured an email alert yet, go here.

Documentation on setting up this type of alert was sparse, and not very clear. This is what I did to get alerts whenever a user logs in from a source not explicitly identified. This took a little creativity since my original method ran into some issues. If I set the alert to go off only once, I would only be notified once (ever) that someone logged in from an unknown address. If I set it to unlimited notifications, every time the agent updates, I would get an email.

Overview

1. Create a custom module
2. Create a template with a regular expression criteria
3. Then create an alert.

Steps to Follow:

1. Log into your agent server via ssh.
2. Edit the config:

   nano /var/lib/pandorafms/agent/pandora_agent.conf

   Or, if you have pandora_agent_daemon (do ls /etc/init.d/ to see if you have pandorafms-agent (above) or pandora_agent_daemon (below)

   nano /etc/pandora/pandora_agent.conf

3. This is my custom module:

   #UnknownIP
   module_begin
   module_name LastLoginUnkIP
   module_type async_string
   module_exec last | grep -v 'host1\|192.168\|host2' | head -1
   module_description Monitor last user login from Unk IP
   module_end

   1. Basically, the above is a modified version of Last Login
   2. It filters out known hosts, which is the grep -v part and any ip address with 192.168 as part of it.
4. Restart the pandora agent, depending on your version, it’s either:

   service pandorafms-agent restart
   service pandora_agenet_daemon restart

5. Go to Administration->Manage Alerts->Templates
6. Create a new template and name it something like LastLoginUnkIPChange
7. I set the priority to Informational. I’m not sure the difference, except my guess is that it may affect the color of the alert when it fires.
8. In Step 2, you can configure it like below:
   1. Default action is Mail to Ryan. If you don’t have that configured, see this article.
   2. Condition type is set to On Change, which means that whenever the value changes, it will send a notification.
   3. Check off Trigger When Matches.
   4. Press next to go to Advanced Fields. This is where we set the message information.
9. Leave the first few fields blank (depending on how many your Mail To action uses). If you use Field1 and Mail To is set to use Field1, your text won’t be transmitted.Here’s what I have in Field 3:

   Hello, this is an automated email coming from Pandora FMS
   
   This alert has been fired because the last user login is from an unknown address:
   
   Agent : _agent_
   Module: _module_
   Module description: _moduledescription_
   Timestamp _timestamp_
   Current value: _data_
   
   Thanks for your time.
   
   Best regards
   Pandora FMS
   

10. Press Finish and now we need to create an alert.
11. Go back to Administration->Manage Alerts and press Create
12. Fill out like below:
    1. Agent: Choose your agent you’d like to apply to.
    2. Module: Choose LastLoginUnkIP since that’s our custom module.
    3. Template: Choose your template you just made.
    4. Action: should be able to leave it at default action for the template.
13. Press add alert and test to confirm.
14. Everything should be done, if it’s working, you should get an email like so:

Documentation on setting up this type of alert was sparse, and not very clear. The below is an example of an alert based on a string match — basically, whenever the data from a certain module matches a string that we specify, it will fire an alert. This was originally created for LastLogin, but I updated that here to address Pandora’s lack of multiple criteria (e.g. On Change and RegEx match).

Overview

1. Create a template with a regular expression criteria
2. Then create an alert.

Steps to Follow:

1. Go to Administration->Manage Alerts->Templates
2. Create a new template and name it. 
3. I set the priority to Informational. I’m not sure the difference, except my guess is that it may affect the color of the alert when it fires.
4. In Step 2, you can configure it like below:
   1. Default action is Mail to Ryan. If you don’t have that configured, see this article.
   2. Condition type is set to “Regular Expression” which means RegEx format. That wasn’t very clear in the documentation.
   3. Leave the Trigger When Matches unchecked, so that we can create basically an exclusion list of domains/hosts to not fire an alert.
   4. The value to set if you want multiple hosts excluded from the alert is:
      1. (hostname1|hostname2|internalip|etc…)
      2. What the above says is if in the data field from LastLogin there is a match (no need for wildcards) for hostname1 OR hostname2 OR 192.168 OR …, don’t send an alert. If it’s anything else, send an alert.
      3. Max number of alerts sets how many times it will be fired before it stops letting you know.
      4. TIP: check your agents to see what they show in the data field for Last Login. I noticed that long hostnames were truncated, so instead of typing in “ryanhallman.com,” I had to put in “ryanhallman”.
5. Press next to go to Advanced Fields. This is where we set the message information.
6. Leave the first few fields blank (depending on how many your Mail To action uses). If you use Field1 and Mail To is set to use Field1, your text won’t be transmitted.Here’s what I have in Field 3:

   Hello, this is an automated email coming from Pandora FMS
   
   This alert has been fired because the last user login is from an unknown address:
   
   Agent : _agent_
   Module: _module_
   Module description: _moduledescription_
   Timestamp _timestamp_
   Current value: _data_
   
   Thanks for your time.
   
   Best regards
   Pandora FMS
   

7. Press Finish and now we need to create an alert.
8. Go back to Administration->Manage Alerts and press Create
9. Fill out like below:
   1. Agent: Choose your agent you’d like to apply to.
   2. Module: Choose LastLogin since that’s what we created our template for.
   3. Template: Choose your template you just made.
   4. Action: should be able to leave it at default action for the template.
   5. Number of alerts to match: this can be less than what’s specified in the template, but not greater than.
10. Press add alert and test to confirm.
11. Everything should be done, if it’s working, you should get an email like so:

1. Drop into root account

   apt-get update && apt-get install pandorafms-agent

2. Pandora will install from the repositories and start itself upon completion of install. We need to reconfigure it to point to our PandoraFMS server.
3. Stop the pandora agent service

   # service pandorafms-agent stop

4. If it gives an error, or can’t find the service, type in:

   # ls /etc/init.d/ | grep pandora
   

5. Based on the output, that’s the name of the service. One of my previous installs was pandora_agent_daemon.
6. Edit the config file to point it to your Pandora server, if not localhost:

   # nano /etc/pandorafms/pandora_agent.conf

7. Go to the server_ip section and change it from localhost to the IP of your pandora server:

   # General Parameters
   # ==================
   
   server_ip       192.168.XX.XXX
   

8. Restart the pandora service and you should now see it in your Agent List on the Pandora Server.

   # service pandorafms-agent start