Strange Message in SMTP Virusscan Log

Hi all,

quite old thread but still relevant. I can see the same message in my SMTP log for all internal domains on UTM version 9.414. Is this by design when you do not have configured SMTP profiles?

Thanks
Daniel

Scanning can be skipped if the attachment is large or encrypted, depending on site sertings.  Could these apply in your situation?

Hi, I just checked that but no, it also happens for emails without any attachment. Thanks for the hint though.

Hi,

In UTM, we scan mail for AV at two places. at

1. At the time when email is accepting (SMTP time).
2. At time email policy applies (policy time).

If you want to reject malware at SMTP time use enable "SMTP->malware->Scan During SMTP Transaction".

If this config is disabled then you can find logs like "Skipping SMTP inline AV scan for this message" but, policy time AV scanning is performed. When you check full logs you can find other log lines like " AV: calling CSSD for single scan (engine: PRIMARY)". This scanning logs are pointing av scan perform at policy time (dual / Single).

In short, this is normal behavior.

Thanks

Hi Sachin,

that sounds reasonable. Thanks for clarifying.

Daniel

Hi Sachin,

that sounds reasonable. Thanks for clarifying.

Daniel