{"record":{"id":"5a3c5e259f72fba4","repo":"stamparm/maltrail","slug":"alert-webhook-post-failed-s","errorCode":null,"errorMessage":"alert webhook POST failed ('%s')","messagePattern":"alert webhook POST failed \\('(.+?)'\\)","errorType":"console","errorClass":null,"httpStatus":null,"severity":"error","filePath":"core/alert.py","lineNumber":161,"sourceCode":"    from collections import OrderedDict\n    return json.dumps(OrderedDict((key, event.get(key, \"\")) for key in\n                                  (\"timestamp\", \"sensor\", \"severity\", \"src_ip\", \"src_port\", \"dst_ip\",\n                                   \"dst_port\", \"proto\", \"type\", \"trail\", \"info\", \"reference\")))\n\n\ndef send(event):\n    \"\"\"POST one event. Never raises: a webhook outage must not stop the server or the tailer.\"\"\"\n\n    payload = body(event)\n    if payload is None:\n        return False\n\n    try:\n        retrieve_content(config.ALERT_WEBHOOK_URL, data=payload.encode(UNICODE_ENCODING),\n                         headers={\"Content-Type\": \"application/json\"})\n        return True\n    except Exception as ex:\n        log_error(\"alert webhook POST failed ('%s')\" % ex, single=True)\n        return False\n\n\ndef process(line):\n    \"\"\"Filter, throttle and send one log line. Returns True when a message went out.\"\"\"\n\n    event = parse_event_line(line)\n    if event is None or not wanted(event) or throttled(event):\n        return False\n    return send(event)\n\n\ndef _log_path(sec=None):\n    localtime = time.localtime(time.time() if sec is None else sec)\n    return os.path.join(config.LOG_DIR, \"%d-%02d-%02d.log\" % (localtime.tm_year, localtime.tm_mon, localtime.tm_mday))\n\n\ndef _tail_once(state):","sourceCodeStart":143,"sourceCodeEnd":179,"githubUrl":"https://github.com/stamparm/maltrail/blob/77cfb06d7606506d101bbcec0786c77166c4255e/core/alert.py#L143-L179","documentation":"Maltrail's webhook alert sender POSTs the alert payload as JSON to ALERT_WEBHOOK_URL via retrieve_content. Any exception from that HTTP call is caught and logged as \"alert webhook POST failed (...)\"; send then returns False, so no alert is delivered through the webhook channel.","triggerScenarios":"The HTTP POST to config.ALERT_WEBHOOK_URL raises: DNS resolution failure, connection refused/timeout, TLS errors, or a non-2xx response raised by retrieve_content. Raised from send, which is invoked by process for each filtered log line.","commonSituations":"Webhook URL typo'd or pointing at a service that is down; local Slack/Mattermost relay unreachable; firewall or proxy blocking outbound HTTPS from the Maltrail host; the endpoint requiring auth headers Maltrail does not send.","solutions":["Verify ALERT_WEBHOOK_URL is reachable from the sensor host: curl -X POST -H 'Content-Type: application/json' -d '<payload>' $URL.","Check DNS, proxy and firewall settings on the Maltrail host.","Confirm the receiving webhook service is running and returns 2xx for the posted JSON.","Inspect the logged exception text ('%s') for the exact cause (timeout vs connection refused vs HTTP status)."],"exampleFix":"# before\nALERT_WEBHOOK_URL = \"http://localhost:9999/hook\"  # nothing listening\n\n# after\nALERT_WEBHOOK_URL = \"https://hooks.example.com/services/xxxx\"  # verified with curl","handlingStrategy":"try-catch","validationCode":"import urllib.request\ntry:\n    urllib.request.urlopen(urllib.request.Request(config.ALERT_WEBHOOK_URL, data=b'{}', headers={'Content-Type':'application/json'}), timeout=5)\nexcept Exception as ex:\n    print('webhook unreachable:', ex)","typeGuard":"def webhook_configured(cfg):\n    return bool(cfg.ALERT_WEBHOOK_URL) and cfg.ALERT_WEBHOOK_URL.startswith(('http://','https://'))","tryCatchPattern":"try:\n    ok = alert.send(payload)\nexcept Exception:\n    ok = False\nif not ok:\n    fallback_log(payload)  # write alert to disk/queue for replay","preventionTips":["Verify ALERT_WEBHOOK_URL with a test curl after every config change","Monitor the sensor host's outbound HTTPS path (proxy, firewall, DNS)","Point the webhook at a local relay that buffers/retries to the real service"],"tags":["python","http","webhook","alerts"],"backgroundTag":"http-request-failed","analyzedSha":"77cfb06d7606506d101bbcec0786c77166c4255e","analyzedAt":"2026-09-13T03:50:16.010Z","contentChangedAt":"2026-09-13T03:50:16.010Z","schemaVersion":2},"datasetVersion":"2026-09-16T09:17:16.951Z"}