Cisco ESA anti-spam update doesn't start automatically

[Ruzanna Zohrabyan]

Hi everyone,

I have a problem with my Cisco Email Security Virtual Appliance with evaluation license. The feature keys are active. After implementation it have worked fine, but one day it started skip  anti-spam checking, I have received spams. When I checked details, I see such errors:

Message 14986 encountered CASE down (1/10). Retry scanning in 12 seconds.

Message 14986 encountered CASE down (2/10). Retry scanning in 12 seconds.

Message 14986 scanned by Anti-Spam engine: CASE. Interim verdict: Engine timeout

That day I have solved my issue by writing "antispamupdate ironport force" command in the CLI, but after that Anti-spam update doesn't start automatically, I must write "antispamupdate ironport force" command anytime.

How can I solve it?

Thanks in advance!

[Libin Varghese]

Hi,

If you see recurring anti-spam errors like mentioned above it would suggest a possible corruption of the engine.

I would recommend opening a TAC case for someone to review and see if those errors can be corrected.

The antispam engine should ideally check for updates automatically every 5 minutes as per the default configuration for updates, this can be confirmed using the updater_logs on the appliance to see if there are any additional errors with the updates being fetched.

- Libin V

[Ruzanna Zohrabyan]

Thank you for your reply, but I cannot open TAC case as it's lab environment with evaluation license.I am testing ESA for replacing existing Microsoft anti spam system. So have you another solution?

Thanks in advance!

[dmccabej]

Hello,

If this is for a lab environment and you do not have access to Cisco (TAC) Support, my personal recommendation would be to simply spin up a new VM and export/import the configuration onto the new VM. If there is corruption within the CASE engine, I'm not sure of any other way to resolve it (outside of TAC remote access) if force updating the engine is not working. 

Thanks!

-Dennis M.

[romankral-tmpst]

Forcing CASE updates helped me.

antispamupdate ironport force