Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements
Email Security Quick-links: ESA Product Support | SMA Product Support | Email Submission and Tracking Portal | Cisco SecurityHub
Current General Deployment (GD) Releases:
ESA: 11.0.0-264 WSA: 10.5.1-296 SMA: 11.0.0-115 Email Plug-in (Reporting): 1.0.1-048 Email Plug-in (Encryption): 1.0.0-036

New Member

[MFC] Error Importing logs using SCP - "Error while downloading file. The remote host has terminated the connection"

Background: 

In order to transfer logs to MFC, we had to use an intermediate logging server in our OOB network.  When this logging server crashed we had to rebuild the server with new hardware and SCP no longer worked.

Issue: 

The host key changed on the new server and had to be manually updated.  We suspected it was related to the hosts key but had difficulty finding where the known hosts info was stored.

Solution: 

Go to your install location of MFC and remove the known_hosts file.  In our case the file was located at:  "D:\Program Files\IronPort Systems\Mail Flow Central\mailFC\tmp\known_hosts".  Instead of removing the file, we renamed it to known_hosts.old and restarted the MFC service.  Afterwards we could see all the old logs importing.

The issue itself was not difficult to resolve, it just took more time than expected for something that would seem straightforward.  To complicate things, we even raised a query to customercare who came back saying that they do not support the server on which MFC is running.  But clearly the source of the issue was related to the application rather than the server itself.

Everyone's tags (3)
394
Views
0
Helpful
0
Replies