Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements
Email Security Quick-links: ESA Product Support | SMA Product Support | Email Submission and Tracking Portal | Cisco SecurityHub
Current General Deployment (GD) Releases:
ESA: 11.0.0-264 WSA: 10.5.1-296 SMA: 11.0.0-115 Email Plug-in (Reporting): 1.0.1-048 Email Plug-in (Encryption): 1.0.0-036

New Member

SMA cannot realase quarantined mails

Hi Everybody,

Hi configured my ESA C370 (v8.0.1) to centralize all its quarantines to my SMA M670 (v8.1.1). This works well.

But when I connect to the SMA and release a quarantined mail, the mail never leave the SMA.

I got the following lines on my SMA mail_logs :

Thu Jan  9 18:13:36 2014 Info: MID 12 released from quarantine "Virus" (manual) t=362

Thu Jan  9 18:13:36 2014 Info: MID 12 released from all quarantines

Thu Jan  9 18:13:36 2014 Info: MID 12 queued for delivery

Thu Jan  9 18:13:36 2014 Critical: An application fault occurred: ('egg/command_client.py send_message|525', "<class 'Commandment.NotConnectedError'>", 'hostname: Not connected.', '[egg/smtp_client.py run|852] [egg/smtp_client.py _run|899] [egg/smtp_client.py _connect|1031] [egg/omh.py get_mx_ip_list|1523] [egg/quarantine_smtp.py get_prioritized_ip_list|699] [egg/quarantine_smtp.py as_mx_response|636] [egg/quarantine_smtp.py get_cpq_host|670] [egg/sma_communicator.py get_cpq_release_interface|42] [egg/sma_communicator.py get_esa_data|82] [egg/command_client.py call|237] [egg/command_client.py send_message|525]')

Could you help me ?

I tryed with two different ESA and with mail in quarantine Policy and Virus.

Best Regards,

Quentin

Everyone's tags (2)
1 ACCEPTED SOLUTION

Accepted Solutions
Cisco Employee

SMA cannot realase quarantined mails

This is a seen defect in the OS:

CSCug22127 - App faults seen in PVO page when ESA not available/PVO disabled

From the SMA - you may need to 'deleterecipients' - if you had a stale/old message in queue, and then upgraded to 8.0.1 or newer, this message will not process through correctly - and has to be removed.  In the past, I have seen two/three emails of this nature --- once the queue is cleared of the messages, and then 'delivernow' issued - this cleared that app fault from occurring.

Hope this helps!

-Robert

(*If you have received the answer to your original question, and found this helpful/correct - please mark the question as answered, and be sure to leave a rating to reflect!)

5 REPLIES
Cisco Employee

SMA cannot realase quarantined mails

This is a seen defect in the OS:

CSCug22127 - App faults seen in PVO page when ESA not available/PVO disabled

From the SMA - you may need to 'deleterecipients' - if you had a stale/old message in queue, and then upgraded to 8.0.1 or newer, this message will not process through correctly - and has to be removed.  In the past, I have seen two/three emails of this nature --- once the queue is cleared of the messages, and then 'delivernow' issued - this cleared that app fault from occurring.

Hope this helps!

-Robert

(*If you have received the answer to your original question, and found this helpful/correct - please mark the question as answered, and be sure to leave a rating to reflect!)

New Member

SMA cannot realase quarantined mails

Thank you for your answer !

I already was in AsyncOS 8.1.1 on SMA, so I did 'deleterecipients' and reboot the appliance, and now everything is fine.

Cisco Employee

SMA cannot realase quarantined mails

Awesome!  I came across this exact scenario just the other week.  Glad it helped!

-Robert

New Member

SMA cannot realase quarantined mails

Hi Robert,

Would this solution apply to a c370 running Async 7.6.3?  I have the same issue of quarantined email following data migration ...

Thanks,

Chris

Cisco Employee

SMA cannot realase quarantined mails

Received a similar app fault?  You can 'grep' the mail_logs, and see if/when/quantity of app faults to see.  It would be entirely possible - I have only come across this a few times recently.  If the emails are in quarantine, and deemed "ok" to remove w/o issue - then try 'deleterecipients'.

I only see the one current open defect, and currently is only listed against 8.1.1 - which is SMA only.

1175
Views
0
Helpful
5
Replies