Rich,
There are several possibilities here. One is that the discrepancy involves messages that aged out, or expired.
Depending on the version of Async OS your running there may be other answers. We would likely need to see more data , such as the configuration of the appliance or access to the appliance itself to understand exactly why your seeing these numbers.
Question:
Sum in "Incoming Mail Summary" does not match the "Total Attempted Messages" on SMA
Environment:
Cisco Ironport Email Security Appliance (ESA) - AsyncOS 7.0.0-105 or higher
Cisco Ironport Security Management Appliances (SMA) - AsyncOS 6.7.3 or lower
Running "Centralized Reporting"
Marketing Detection enabled
Symptoms:
Sum of "Total Threat Messages" and "Clean Messages" does not match what is seen in "Total Attempted Messages".
Solution:
When running "Centralized Reporting", SMA collects reporting data from ESA.
Starting AsyncOS 7.0.0 on ESA, we have introduced new reporting counters for "Marketing Messages".
On ESA, if you look under "Monitor > Overview" you would notice a new field named "Marketing Messages".
This new field does not exist on older versions of SMA.
When SMA pulls data off of ESA, it does not understand this newly introduced counter and ignores them.
As a result, reports generated on SMA would show discrepancies when adding up "Total Threat Messages" and "Clean Messages" against "Total Attempted Messages"
Latest AsyncOS 6.7.6-076 for SMA has the marketing counters implemented.
Upgrading to this version should fix the discrepancies going forward.
Unfortunately, counters which was missed prior to upgrading are already lost and would not recover after upgrade.
You will continue to see the discrepancies till the data rolls over.
Reference:
Bug 47910
You may want to open a support ticket so we can review this issue in more detail.
Christopher C Smith
CSE
Cisco IronPort Customer Support
