[9.303-2] AV Scanner Unreachable

Hi,

I have seen this issue a few times now, but I should have been solved back in 9.204:

SMTP LOG:

2014:12:10-08:46:11 fw01 smtpd[4007]: SCANNER[4007]: id="1001" severity="info" sys="SecureMail" sub="smtp" name="email quarantined" srcip="192.168.111.35" from="***@***.com" to="yyy@yyy.com" subject="mail users" queueid="1Xybxj-00012d-8O" size="49381" reason="unscannable" extra="AV Scanner unreachable"

2014:12:10-08:46:11 fw01 smtpd[4007]: SCANNER[4007]: 1Xybxd-00012F-1E Sending 'Message delivery incomplete' notification to ***@***.com

Have others seen this?

Parents

0 twister5800 over 9 years ago

Hi Ian,
I use the standard setup with dual scan and have Sophos a preferred av scanner in system settings.

I have not tried to set it to single scan.

Customers WAN LINk is maxed out during backup (100Mbit on a UTM120), so the CPU is busy, could it be that it fails because it cannot contact Sophos Servers SXL??

-----

Best regards
Martin

Sophos XGS 2100 @ Home | Sophos v20 Architect
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 RFCat_vk_01 over 9 years ago in reply to twister5800

Hi Martin,
I should have been more explicit. What is your setup for scanning, what is and isn't scanned. What happens to unscannable messages?

Ian
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 twister5800 over 9 years ago in reply to RFCat_vk_01

Hi Martin,
I should have been more explicit. What is your setup for scanning, what is and isn't scanned. What happens to unscannable messages?

Ahh sorry...my bad [;)]

I have not "winked" the "Quarantine unscannable and encrypted content", so basically is it setup as UTM default.

It only gives this quarantine message because the AV Scanner is unreachable.

This error is when user sends mail through exchange which has the UTM as smart host...but only SOME messages gives this error.

-----

Best regards
Martin

Sophos XGS 2100 @ Home | Sophos v20 Architect
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 bulirich_01 over 9 years ago in reply to twister5800

Hi,

if this problem still exists could you please check /var/log/fallback.log , there might be hints about the av engines. Also you might check /var/storage/cores for possible coredumps.

Regards,
Benjamin
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel

Reply

0 bulirich_01 over 9 years ago in reply to twister5800

Hi,

if this problem still exists could you please check /var/log/fallback.log , there might be hints about the av engines. Also you might check /var/storage/cores for possible coredumps.

Regards,
Benjamin
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel

Children

No Data