Resource conservation for C690

[karl.rosenbaum]

I have recently updated my ASyncOS to the latest version; 13.5.1-277 due to some CVEs released for the code that I was running.  I have not changed any other configurations to the devices, but I am now going into resource conservation mode several times a day on each device configured to receive email from outside my enclave.  I have my MX records evenly weighted between 6 separate C690s in different areas of the continental US.   I am not seeing memory usage go up, just the amount of messages in queues shoot up.  It does settle down eventually.

Before calling TAC, has anyone experienced this with the most current code?  

Thanks,

ker

[balaji.bandi]

is this a genuine emails ? " just the amount of messages in queues shoot up"  since email system, we see randomly by attackers try to send spam or junk email and mail filter does filtering.

how is your Load sharing TTL config done over all 6 boxes ?

[karl.rosenbaum]

These are all legitimate emails; not spam, etc.  

My TTL has remained the same for all of my MX records for the last 5 years; 60 mins.

No changes have been made other than the ASyncOS.

[marc.luescherFRE]

Resource conservation only exists on hardware based ESA/SMA devices.

It means in short that with all the current enabled security services AND the high number of incoming attempts the workqueue would be backed up soo much that some security services will be disabled temporarily. This is a very bad situation to be in and you should either try to isolate the offender so you can block it early in the pipeline and get all security services back on again.

[MohdZulFahmiHassan06801]

Hi.

does anyone know how to esa going resource conservation?

it make email send/received slow.

[SriramV]

ESA may enter into Resource Conservation mode when Mem usage goes more than 75%

there is no one reason for that.

Cisco ESA C390 Resource Conservation mode

Request to check TAC to analyze the ESA stats and ESA config.

you can also try reversing any recent config change.