Mail Being blocked as SPAM

Question

Hi, 
 We run a UTM9 (virtual appliance) and have many customers using hardware SG appliances. This afternoon we have have many reports of email issues, with sending and receiving from a variety of company addresses and gmail.com / hotmail.com domains. 
 According to the mail manager all of the emails are being dropped as confirmed spam. Is this a dodgy pattern update? 
 Internally we are currently on FW 9.601-5 and pattern 161467. 
 I have switched reject at smtp time to off and emails are now getting quarantined. Have logged a support call with Sophos via email and am in the phone support queue. 
 Any one else experiencing this? 
 Rgds 
 Asim

Tungmeister · Accepted Answer

Guys I think I've worked out a fix for the issue. 
 ssh onto the appliance - and then stop both the ctasd services: 
 /var/mdw/scripts/ctasd_outbound stop 
 /var/mdw/scripts/ctasd_inbound stop 
 then before they restart themselves rename the ctasd cache directory: 
 mv /var/cache/ctasd /var/cache/ctasd.old 
 Once the services restart emails seem to be coming through fine.

Tungmeister · Answer

I wrote the rename command in notepad before hand then pasted it in so I could do it before they brought themselves back up.

PhilBrock · Answer

EDIT to say this does appear to have worked on both boxes we were seeing issues on (looks like the second box was a single false positive) 
 
 This appears to have worked on one of our boxes, mail flow now appears to be working ok. Have tried on another box and it still appears to be overblocking....go figure!

FloSupport · Answer

Hi Tungmeister 
 Thank you for sharing this with the community! 
 The same commands have also been published on the published advisory article for this issue. 
 
 Advisory: Sophos XG, UTM, Cyberoam and Central Email may be quarantining legitimate emails 
 
 Regards,