PureMessage Exchange DAG - double quarantine spam digest?

Hey Ben,

Did you ever get this fixed?  We seem to have the exact same issue with an Exchange 2016 DAG.

Afraid not. I had a support ticket open and was supposed to be running some debug on SQL but I never got around to doing it and my case was closed. It still doesn't work properly. If you find a solution with Sophos please update here.

Hey Ben,

I opened a support ticket and the answer from the support agent is:

"I've received a response from the Global Escalations team, it isn't doable unfortunately. Puremessage produces one email per server. It is not possible to merge these into one email."

So I'm guessing its not possible.

Regards

Hi SysAdmin,

Sorry I don't buy this, sounds like you were fobbed off. I got quite far up the escalation process and was told this should have worked.

Why on earth would puremessage collect all spam entries in one database, and also DFS replicate all the spam messages between all cluster members, if then the end user can only see and manage emails on one server.

What happens in a cluster of 10 servers all receiving inbound mail? Is the user expected to to receive 10 separate emails and manage them all. I don't think so.

I may revisit this with Sophos one day, but the answer you received sounds like nonsense to me.

Thanks.

In addition, all the entries of all servers can be viewed in the console as a single list and can all be managed, why wouldn't the end users be able to do the same? If that really is the case this software is not fit for purpose in my opinion.

Hi Ben Goodfellow1 

I have checked this with our global escalation team, unfortunately, the feature you are looking for is not available as each server will send a digest email as soon as there is a message in quarantine. Apologies for the inconvenience caused.

Hi Shweta,

Thank you for the reply. However I have to disagree. A digest email is sent once per day rather every time a message enters the quarantine. I also would expect the global escalation team to have given some explanation why we (administrators) can see the entire quarantine across all servers, but not for the end-users. This makes no sense at all. Why go to all the bother of developing software that can combine data (all held in a central database), and replicate all failed suspected spam messages across ALL servers, to then only present the ones held on one server to the end user. And on top of that send multiple emails to end users if more than one Exchange server exists.

If this really is the case, yours software is total rubbish and you need to redevelop it. It's been the same since 2013.

Also I would note that your Puremessage for Unix does this (i.e combines quarantine emails from multiple servers for end users to digest). It does exactly what the software for Windows (Exchange) should do. Perhaps you can get an answer from a developer rather than 1st line global.

Thanks.

Hi Ben Goodfellow1 

I certainly understand your concern, but this is something that is beyond the puremessage capability as of now.