Just last weekend, our Bro cluster started randomly skipping emailed
reports. No change has been made to the Postfix configuration or the Bro
configuration. There seems to be no pattern to the missed reports, which
are supposed to be sent out every 2 hours. Sometimes they are sent,
sometimes not. The logs show nothing at all, not even an attempted send for
the missing reports, the report simply isn't there.
Sorry, no immediate idea. Does this apply to both the alarm mail
and the traffic summaries? Are Bro's log files rotated and archived
correctly?
There's no logging for the reporting, so it's hard to say what's
going on. You could add some debugging output to the
postprocessor/{mail-log,summarize-connections} scripts to see if
they get executed.
Robin