ESA Alert

[kishorsawant1988]

Please help me to understand this alert from Ironport ESA

The Warning message is:

Invalid SimpleFilter: Block_Pornography rule: <filters.URL_Category_Rule instance at 0x94a8a758>('egg/filters.py _walk_parts|3040', "<type 'exceptions.AttributeError'>", "'NoneType' object has no attribute 'get_content_type'", '[egg/filters.py process|10384] [egg/filters.py eval|1546] [egg/filters.py evaluate_and_fetch_urlinfo|1402] [egg/filters.py evaluate_message|2821] [egg/filters.py _walk_parts|3040]')

Invalid SimpleFilter: URL_category_2 rule: <filters.URL_Category_Rule instance at 0x9a042050>('egg/filters.py _walk_parts|3040', "<type 'exceptions.AttributeError'>", "'NoneType' object has no attribute 'get_content_type'", '[egg/filters.py process|10384] [egg/filters.py eval|1546] [egg/filters.py evaluate_and_fetch_urlinfo|1402] [egg/filters.py evaluate_message|2821] [egg/filters.py _walk_parts|3040]')

Last message occurred 2 times between Thu Feb 26 11:32:02 2015 and Thu Feb 26 11:35:23 2015.

Invalid SimpleFilter: specific_category_blocks rule: <filters.URL_Category_Rule instance at 0xa6e48320>('egg/filters.py _walk_parts|3040', "<type 'exceptions.AttributeError'>", "'NoneType' object has no attribute 'get_content_type'", '[egg/filters.py process|10384] [egg/filters.py eval|1546] [egg/filters.py evaluate_and_fetch_urlinfo|1402] [egg/filters.py evaluate_message|2821] [egg/filters.py _walk_parts|3040]')

Last message occurred 2 times between Thu Feb 26 11:32:02 2015 and Thu Feb 26 11:35:23 2015.

[Robert Sherwin · Accepted solution]

Have you upgraded or changed anything on the appliance of late?  

More than likely you are hitting this open defect:

CSCuq97659 - Invalid SimpleFilter Alerts being generated for messages without headers

Symptom:
URL Content filter does not trigger on a message.

A warning message is logged in the mail_logs as well as an Alert is been generated.

Warning: Invalid SimpleFilter: test rule:  ('egg/filters.py _walk_parts|3040', " ", "'NoneType' object has no attribute 'get_content_type'", '[egg/filters.py process|10384] [egg/filters.py eval|1546] [egg/filters.py evaluate_and_fetch_urlinfo|1402] [egg/filters.py evaluate_message|2821] [egg/filters.py _walk_parts|3040]')

Conditions:
ESA is configured to NOT add received headers on listener level and a message is injected without any mail headers.

Workaround:
Enable "Add Received Header" on listeners from:
GUI -> Network -> Listeners ->  -> Advanced

-Robert