Mail Flow Central Error

[Alex Brillhart]

I have recently noticed that  MFC seems to be having issues parsing timestamp from a log from my ESA appliance.  However, I can't seem to locate the log.  Logs are sucessfully being imported, however I continue to get emailed every 15 mintues because of this one issue.  If I could find the issue then I would just delete it.  How can I either fix the root issue or get it to stop emailing me every 15 minutes?  Cisco Support basically said since MFC is no longer supported then it is not our issue.  I don't have any errors like this on our 2nd ESA appliance.  This issue just came up over the weekend. 

Any suggestions?

An error has occured:

Error(s) while preparing to fetch log files from host XXX.XXX.XXX.XXX:

mail.@20151101T015959.1.s

    Error parsing timestamp '20151101T015959.1' from file name (skipping)

[Hrvoje (Harry) Dogan]

Hi Alex,

Wow, I can't believe someone still uses Mail Flow Central!! :D Can you connect to the problematic appliance with FTP and send the output of the mail_logs directory listing to the thread? Have there been any actions performed by TAC on the box around the 1st of November? Any unplanned shutdowns/crashes, anything like that?

Thanks,

Harry

[Hrvoje (Harry) Dogan]

Actually, I just managed to reproduce the issue. If mail_logs are rolled over twice within one second, you will get a file named with .1 after the timestamp:

-rw-rw---- 2 root log 328 Nov 3 12:19 mail.@20151103T121854.1.c
-rw-rw---- 1 root log 293 Nov 3 12:18 mail.@20151103T121854.s

I guess for some reason your logs rolled over twice at 2 AM on the 1st of November. What I'd suggest is to ftp into the box and just rename the ".1.s" file into a second later, i.e. mail.@20151101T020000.s. 

As a matter of fact, I maye have an idea why as well. You probably have hourly log rotation configured. On Nov 1 at 2 AM, US moved away from DST. Thus, your mail.@20151101T015959.1.s is actually mail.@20151101T025959.s with DST.

Right after mail.@20151101T015959.s was rolled over, the clock moved back to 01:00:00, and rolled over again at 01:59:59 making it a duplicate file.

Hah, mistery solved! A rename should solve your MFC problem too :) However, you should talk to your Cisco Sales Representative to switch to Message Tracking and Centralized Reporting on the SMA.

[Alex Brillhart]

Harry,

Thanks for your response.  I will try to find the duplicated log file on the ESA and then either move it over manually or rename it.

[Hrvoje (Harry) Dogan]

Please let me know if it worked. I am amazed that MFC still works and it hasn't been broken by all the new logging information introduced in the past 5 years...