New SBRS issue?

[Bob Fayne]

Has anyone else heard of a new issue with SBRS lookups?

Cisco support is telling me that there is a "software defect/bug" in version 7.6.0 and 7.6.1 that affects SBRS lookups but it only started in the last 24 hours after they pushed out some sort of update for Senderbase. All messages are coming in as unable to retrieve the SBRS score.

I can still get the score using a manual lookup but all my appliances are not able to get an SBRS score. When I view details on a message with Message Tracking that's where I see "unable to retrieve."

Supposedly this has been fixed in 7.6.2 which is not yet available so they are implementing a manuak wrorkaround.

[Sebastian Amting]

Hi Bob,

thanks for posting.

This issue may occur if you are running an appliance on a 7.6.x version with IPAS enabled and Outbreak Filters disabled which has been upgraded from 7.5.x in the past. If your appliance is affected, you will see/receive an error message similar to the following:

Problem Details: The Critical message is:

An application fault occurred: ('aplib.oserrors.pyxaplib.oserrors.map_exception (aplib/aplib.oserrors.c:463)|28', ">> 'aplib.oserrors.ENFILE'>", '[Errno 23] Too many open files in system','[egg/dns_cache.py send_request|244] [socket.pyx coro._coro.make_socket'(coro/_coro.c:24967)|1468] [socket.pyx coro._coro.sock.__init__

(coro/_coro.c:17645)|218] [pyrex_helpers.pyx coro._coro.raise_oserror (coro/_coro.c:2701)|12 [aplib.oserrors.pyx aplib.oserrors.map_exception (aplib/aplib.oserrors.c:463)|28]') why: [Errno 23] Too many open files in system

Version: 7.6.1-022

Serial Number: xxxxxxxxxxxx-FTXxxxxxxxx

Timestamp: 13 Dec 2012 07:49:00 +0800

For anyone seeing this issue, please do reach out to support right away and enable remote access to your appliance so we can apply the workaround available.

Our development and quality assurance teams are currently working on finalizing a fix for this issue and we are currently expecting this fix to be available within the next few hours. The fix will be applied automatically via the regular updates process of the appliance.

Thanks,

Sebastian

--

Sebastian Amting

Manager Technical Support

Content Security Technical Services

[mauricioharley]

Hello, Sebastian,

I'm facing this problem right now.  What is the workaround to apply while definitive fix is not available?

Regards,

Maurício

[Lars Adolfsson]

Hi Sebastian

I also have this problem right now.

What can we do to fix it.

Regards,

Lars

[acheron1555]

Hi,

I'm facing this problem for last 3 days. If I restart Ironport, it works normally maybe 12 hours. After this time IronPort will start generate Critical message and after some hours it completely stop working and I have to do cold reboot.

I enabled remote access yesterday, so when can I expect applying workarround?

Thanks a lot.

[Sebastian Amting]

Hello All,

a fix for this issue has been released yesterday. The affected engine should be updated automatically via the normal update process.

You can verify if the version containing the fix (1.1.0-011) has been applied using the command repengstatus on the CLI only:

domain.com > repengstatus

Component     Version     Last Updated

repeng_tools  1.1.0-011   16 Dec 2012 18:02 (GMT +00:00)

repeng        1.1.0-011   16 Dec 2012 18:02 (GMT +00:00)

If you are still seeing any issues, please reach out to support, so 1 of our engineers can check the status of your appliance:

        http://www.cisco.com/cisco/web/support/index.html#~shp_contact

Thanks,

Sebastian

--

Sebastian Amting

Manager Technical Support

Content Security Technical Services

[acheron1555]

Hello,

It looks OK from yesterday.

Thanks a lot for your help.

[larry.rosenbaum]

How can I force an update? It's not updating automatically.

[Sebastian Amting]

Hi Larry,

you can force/manually run an update using the command repengupdate force

Although the update itself should fix the issue in most cases, we recommend restarting the appliance once the update is complete to ensure that all processes on the appliance are working as expected again.

Thanks,

Sebastian

[warrnamboolcc]

We also ran into this issue after upgrading from a C160 (Up to date) to a C170 appliance (Full system backup then restore onto new appliacne).

End result of support call was to

Login via ssh

and

"Force all components to update again in order to refresh the reputation engine files, finally restarted the appliance to get all files in effect."

Update force

Thanks

Greg