IronPort 10.0.1-103 Warning - The python was restarted due to an error

[john.abbott]

Hi

Running 2 IronPort C380 appliances on AsyncOS v 10.0.1-103. The appliance which is the default recipient for most external email gets recurring Warnings:

The Warning message is:

The python was restarted due to an error. A debug file was generated for troubleshooting. Please contact your authorized support center.

Version: 10.0.1-103

These are usually preceded ~ 3 minutes prior by another Warning:

The Warning message is:

 Unable to connect to Cisco Web Security Service.

URL Filtering will not work correctly.

Please verify all network, proxy and firewall settings.

Connection to "v2.sds.cisco.com" failed.

The last error seen on this connection: "Request failed with code: 27 ()"

Appears to be Graymail related. I could find 2 similar references but no current resolution:

https://bst.cloudapps.cisco.com/bugsearch/bug/CSCuw26033/?referring_site=bugquickviewredir

https://bst.cloudapps.cisco.com/bugsearch/bug/CSCuz86991/?referring_site=bugquickviewredir

Upgrade to ASYNCOS 10.0.2 for Email (Note: should be available in the first half of 2017)

Please advise on the cause & any currently available remedial actions.

Kind regards - John

[Libin Varghese · Accepted solution]

Hi John,

I've seen this alert to be generated due to graymail service restarting as well as URL filtering service not working as expected.

Below defect is for the URL filtering causing the error:

https://bst.cloudapps.cisco.com/bugsearch/bug/CSCux63499/?reffering_site=dumpcr

https://bst.cloudapps.cisco.com/bugsearch/bug/CSCus08194/?reffering_site=dumpcr

I would recommend updating the configuration for URL filtering using command "websecurityadvancedconfig" (if not already updated) as per the below field notice.

http://www.cisco.com/c/en/us/support/docs/field-notices/641/fn64111.html

Enter URL lookup timeout (includes any DNS lookup time) in seconds:
[5]> 15

Enter the threshold value for outstanding requests:
[50]> 5

Commit these changes and monitor to see if you receive any further alerts.

You may need to disable and re-enable URL filtering in certain cases if you continue to see alerts.

Beyond that would require TAC to investigate through a remote access to the appliance.

Thank You!

Libin Varghese

[john.abbott]

Hi Libin

Thanks very much for such a speedy response. We have applied the changes you recommended & after leaving for a day to see how our IronPort appliances responded, can report that those error messages have now stopped.

Your assistance is much appreciated.

John

[Libin Varghese]

Hey John,

Glad the alerts have stopped after changing the configuration.

Appreciate the update.

- Libin V