Anti-Spam using 98% of CPU on x1070

msxservice · ‎01-21-2015

We have two x1070 ESAs. Both seem to have inbound mail being delayed during the day. The queues slowly grow, anywhere from 500-20,000. Although mail is flowing, messages will be delayed for up to 40 minutes. My solution to get mail back to normal is to disable the Ironport Anti-Spam and queues clear our within minutes.

When anti-spam is enabled, the CPU Utilization is maxxed out. The Anti-Spam seems to always be at 96%-98%!

Is this normal behavior?

And... so you know... I am not an expert or guru with these appliances. I am an Exchange Email admin, and thrown into managing these. I love 'em, but know very little.

Thank you!

-- Mike

brad walker · ‎01-22-2015

I was working on with TAC support on a queuing issues yesterday and was told there is an issue with the latest anti-spam Engine causing CPU issues, this is what i was told:

Cisco TAC Support is tracking an issue with the message processing on the Email Security Appliances where the AntiSpam engine is slow to scan message traffic or is showing a high CPU usage. Escalation Teams are very much aware of this is are working to understand the root cause and how to proceed with a corrective action. At this point AntiSpam scanning is being accomplished, maybe at a slower rate than normal. Please accept our apologizes and ask for patience as we work toward resolution.

- Brad

msxservice · ‎01-23-2015

Thank you Brad, for that information! Greatly appreciated!!! I hope they correct the problem soon.

Mathew Huynh · ‎01-25-2015

Hello Mike and Brad,

Thank you for creating this thread.

I do apologise for the CASE (Spam engine) issues that caused your emails to be delayed to that extent.

While it may be a bit late now, the issue had occurred has been resolved on January 21st.

If the issue is still persisting, i would recommend you to open a Cisco TAC case with us and we'll have it sorted out for you if anything.

As an extra mitigation method I would suggest you go forward with using this command once and monitoring.

CLI > antispamupdate ironport force