Graymail keeps restarting

[denny_strijdonck]

Every 15 minutes I get an e-mail notification with the following text:

-----------------------------------

Subject: Warning <System> *hostname*: The graymail was restarted due to an error. A debug file was...

Text:

The Warning message is:

The graymail was restarted due to an error. A debug file was generated for troubleshooting. Please contact your authorized support center.

Version: 12.5.1-037

Serial Number: ***

Timestamp: 29 May 2020 14:55:00 +0200

To learn more about alerts, visit our support community and troubleshooting site.  In many cases, you can find more information about this specific alert.

For troubleshooting, see the following URL :

https://www.Cisco.com/c/en/us/support/security/email-security-appliance/products-tech-notes-list.html

For ESA Support, see the Cisco Support Community site :

https://supportforums.cisco.com/t5/email-security/bd-p/5756-discussions-email-security

If you desire further information, please contact your support provider.

To open a support request for this issue, access the IronPort C690 and issue the "supportrequest" command. The command sends an email with diagnostic information directly to Cisco IronPort Customer Support to facilitate a rapid diagnosis of the problem.

Thank you.

-----------------------------------

We have 2 ESA's in a cluster, both are generating the same e-mail messages. We've got this version running for a few months now, but the issue only started this night. Anyone here knows what to do with this besides disabling the graymail functionality?

[Ken Stieers]

Open a TAC case, you'll need to open the support tunnel for them.
They'll be able to get the debug file and figure out what's broken and fix it.

Ken

[denny_strijdonck]

Strangely enough the notifications just stopped this weekend without changing anything in the configuration. Maybe it was due to a corrupt entry in the definitions file that was solved during a downloaded update.

[marc.luescherFRE]

We had a similar case just yesterday on one of our 30 appliances. We needed a TAC case and supposingly the backend wiring of how graymail connect back to TALOS needed to be reset.

This did not happen before either.

-Marc

[mathieumayol]

The problem was corrected at the end of the morning, but has returned since around 1h30.

Mathieu

[saliyev]

Dears,

We have experienced global issue with the graymail service on Friday morning (since 09:00 am GMT+2) which also caused high WorkQueue. The issue you are reporting has been resolved at ~10:18 AM GMT+2.
If you are still seeing the alerts you can run the following command from the command line of the appliance:
  > graymailupdate force

For more information you can view our outage page at https://status.ces.cisco.com/ and subscribe to be notified of future outages.

[mathieumayol]

Hello Saliyev,

Thanks foryour reply, yes but issue reappear a 7PM.

And today, same thing ...

Regards

[JWBartlett]

It appears that this issue has returned. We also experienced it on May29.

[mistiielmore]

We are experiencing this as well.  The alerts began on Friday 9/29/2023 and were received every 5 minutes from 2:05 a.m. Central to 3:20 a.m. Central, began again at 12:30 p.m. Central thru 3:10 p.m. Central and then began again today, 10/2/2023 12:30 p.m. Central.  I have not yet opened a TAC case.

[saliyev]

that's right. issue re-occurred during evening hours CES.
Will try to keep posted while get RCA.