cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
3609
Views
0
Helpful
2
Replies

Ironport C170 : encountered CASE down !!

haonan_niu
Level 1
Level 1

Hi All,

The C170 can not update CASE and Web Reputation DB.  I am getting the following messages indicating that the CASE is stopped and the email delayed for almost 13 min before delvered to reciptents.

I try to run the command "antispamupdate ironport force" in the CLI, but still does't work

~~Dears please help me (T_T)~~

Operating System: 9.7.1-066

-----------------------------------------------------------------------------------------------

Rule Updates
Rule Type                               Last Update                       Current Version
CASE Core Files                  Never Updated                        3.5.0-008
CASE Utilities                       Never Updated                        3.5.0-008
Structural Rules                   Never Updated                        3.3.1-009-20141210_214201
Web Reputation DB             Never Updated                        20141211_111021
Web Reputation Rules         Never Updated                        20141211_111021-20141211_170330

--------------------------------------------------------------------------------------------------


28 Mar 2016 19:20:59 (GMT +08:00)
Protocol SMTP interface mail.gcXXXX.com (IP x.x.y.y) on incoming connection (ICID 2636) from sender IP 220.y.y.3. Reverse DNS host m15-3.126.com verified yes.
28 Mar 2016 19:20:59 (GMT +08:00)
(ICID 2636) ACCEPT sender group UNKNOWNLIST match sbrs[-1.0:10.0] SBRS -0.9
28 Mar 2016 19:20:59 (GMT +08:00)
Start message 54753 on incoming connection (ICID 2636).
28 Mar 2016 19:20:59 (GMT +08:00)
Message 54753 original subject on injection: Re: Re:19:20 18:30 (18:31)
28 Mar 2016 19:20:59 (GMT +08:00)
Message 54753 (7281 bytes) from haonan_niu@126.com ready.
28 Mar 2016 19:20:59 (GMT +08:00)
Message 54753 matched per-recipient policy DEFAULT for inbound mail policies.
28 Mar 2016 19:20:59 (GMT +08:00)
Message 54753 encountered CASE down (1/60). Retry scanning in 12 seconds.
28 Mar 2016 19:21:11 (GMT +08:00)
Message 54753 encountered CASE down (2/60). Retry scanning in 12 seconds.
28 Mar 2016 19:21:23 (GMT +08:00)
Message 54753 encountered CASE down (3/60). Retry scanning in 12 seconds.
28 Mar 2016 19:21:35 (GMT +08:00)
Message 54753 encountered CASE down (4/60). Retry scanning in 12 seconds.
........
........
Message 54753 encountered CASE down (58/60). Retry scanning in 12 seconds.
28 Mar 2016 19:32:36 (GMT +08:00)
Message 54753 encountered CASE down (59/60). Retry scanning in 12 seconds.
28 Mar 2016 19:32:48 (GMT +08:00)
Message 54753 processing incomplete. CASE could not be reached
28 Mar 2016 19:32:48 (GMT +08:00)
Message 54753 scanned by Anti-Virus engine Sophos. Interim verdict: CLEAN
28 Mar 2016 19:32:48 (GMT +08:00)
Message 54753 scanned by Anti-Virus engine. Final verdict: Negative
28 Mar 2016 19:32:48 (GMT +08:00)
Message 54753 queued for delivery.
28 Mar 2016 19:32:48 (GMT +08:00)
SMTP delivery connection (DCID 2587) opened from Cisco IronPort interface 10.18.0.18 to IP address 10.18.1.18 on port 25.
28 Mar 2016 19:32:48 (GMT +08:00)
(DCID 2587) Delivery started for message 54753 to haonan.niu@gc-rise.com.
Thanks~
2 Replies 2

Hrvoje (Harry) Dogan
Cisco Employee
Cisco Employee

In cases like this, you should always contact Cisco TAC rather than post on Community Support forum. You can open a support request by issuing "supportrequest" command from he CLI, or from the "Help and Support" menu in the GUI.

For urgent matters (such as this ) you can also call TAC - find your local contact number at http://www.cisco.com/c/en/us/support/web/tsd-cisco-worldwide-contacts.html. 

ahsan11
Level 1
Level 1

I have the same problem. how to resolve? no more firmware update is available now. so cannot just solve by updating firmware like others. Please need urgent help.