AMP Limits

[Doug Maxfield]

Good Morning,

Just trying to find out some information.  We have been having problems with AMP queuing for the past 3 - 4 months.  Started happening in March 2019 and happens every 6 - 8 weeks.  We have opened multiple TACs about this and the solution is that Support either restarts the ESA (we are Cloud) or restarts the AMP services.

It appears that we are hitting a limit as noted in the Message Trace:

Message 14021736 is unscannable by Advanced Malware Protection engine. Reason: Upload Limit Reached

This has been appearing since yesterday on one of our ESAs.  Support stopped/started the service last night around 6pm CDT, but it is still happening today.  I'm trying to find out the limit and if this limit can be increased.  I know that we are running into the following bug:  https://community.cisco.com/t5/email-security/amp-file-analysis-service-threatgrid-cloud/td-p/3301440

But if there is a way to increase our capacity to prevent the queuing and impacting emails to our users, I need to explore this.

Thanks!!!!

Doug

[Ken Stieers]

For sure you can up your limit for threat grid uploads, but did they update your CES to 11.x yet? Newer builds are smarter about what they upload, specifically to help avoid this. Default entitlement for on-prem boxes is 200 per box per day, but you may get more from CES based on your size?

[Doug Maxfield]

Ken, Thanks for the response. We are on ver 12 and Cloud. TAC finally notified us how many uploads we get. We also contacted our Sales staff and found out that we should have unlimited uploads due to the timeframe that we purchased AMP. In reviewing, they found that we were throttled. That got removed yesterday and so far, no problems. We will have the issue of ESA stop responding to AMP. But, supposedly it was fixed in ver 12. It has been escalated for review. Doug

[Ken Stieers]

Hey Doug



Do you have a Threat Grid Device Admin account? You can see most of what that would show you via the Monitoring/File Analysis reports and clicking through, but it's nice to see it all in one place...

Check with your sales team, they may not offer it to CES but I'd think that they would...



Ken

[Doug Maxfield]

Ken,

We do have Threat Grid but that is ran by another team here.  We have asked for access, but so far, have not gotten it.

Doug