Has anyone else heard of a new issue with SBRS lookups?
Cisco support is telling me that there is a "software defect/bug" in version 7.6.0 and 7.6.1 that affects SBRS lookups but it only started in the last 24 hours after they pushed out some sort of update for Senderbase. All messages are coming in as unable to retrieve the SBRS score.
I can still get the score using a manual lookup but all my appliances are not able to get an SBRS score. When I view details on a message with Message Tracking that's where I see "unable to retrieve."
Supposedly this has been fixed in 7.6.2 which is not yet available so they are implementing a manuak wrorkaround.
thanks for posting.
This issue may occur if you are running an appliance on a 7.6.x version with IPAS enabled and Outbreak Filters disabled which has been upgraded from 7.5.x in the past. If your appliance is affected, you will see/receive an error message similar to the following:
Problem Details: The Critical message is:
An application fault occurred: ('aplib.oserrors.pyxaplib.oserrors.map_exception (aplib/aplib.oserrors.c:463)|28', ">> 'aplib.oserrors.ENFILE'>", '[Errno 23] Too many open files in system','[egg/dns_cache.py send_request|244] [socket.pyx coro._coro.make_socket'(coro/_coro.c:24967)|1468] [socket.pyx coro._coro.sock.__init__
(coro/_coro.c:17645)|218] [pyrex_helpers.pyx coro._coro.raise_oserror (coro/_coro.c:2701)|12 [aplib.oserrors.pyx aplib.oserrors.map_exception (aplib/aplib.oserrors.c:463)|28]') why: [Errno 23] Too many open files in system
Serial Number: xxxxxxxxxxxx-FTXxxxxxxxx
Timestamp: 13 Dec 2012 07:49:00 +0800
For anyone seeing this issue, please do reach out to support right away and enable remote access to your appliance so we can apply the workaround available.
Our development and quality assurance teams are currently working on finalizing a fix for this issue and we are currently expecting this fix to be available within the next few hours. The fix will be applied automatically via the regular updates process of the appliance.
Manager Technical Support
Content Security Technical Services
I'm facing this problem right now. What is the workaround to apply while definitive fix is not available?
I'm facing this problem for last 3 days. If I restart Ironport, it works normally maybe 12 hours. After this time IronPort will start generate Critical message and after some hours it completely stop working and I have to do cold reboot.
I enabled remote access yesterday, so when can I expect applying workarround?
Thanks a lot.
a fix for this issue has been released yesterday. The affected engine should be updated automatically via the normal update process.
You can verify if the version containing the fix (1.1.0-011) has been applied using the command repengstatus on the CLI only:
domain.com > repengstatus
Component Version Last Updated
repeng_tools 1.1.0-011 16 Dec 2012 18:02 (GMT +00:00)
repeng 1.1.0-011 16 Dec 2012 18:02 (GMT +00:00)
If you are still seeing any issues, please reach out to support, so 1 of our engineers can check the status of your appliance:
you can force/manually run an update using the command repengupdate force
Although the update itself should fix the issue in most cases, we recommend restarting the appliance once the update is complete to ensure that all processes on the appliance are working as expected again.
We also ran into this issue after upgrading from a C160 (Up to date) to a C170 appliance (Full system backup then restore onto new appliacne).
End result of support call was to
Login via ssh
"Force all components to update again in order to refresh the reputation engine files, finally restarted the appliance to get all files in effect."