What filter or rule is catching the message

[The-Messenger]

I see messages in tracking with lines like this

encountered CASE down (1/10). Retry scanning in 12 seconds

What does encountered CASE down mean?

Next question - can I determine what specific text in a message caused it to be caught by a filter or rule?

Thanks!

[Mathew Huynh]

Hello The-Messenger,

CASE down would be indicating the Anti-spam engine may have not reachable by the device at the time of the email scanning and it would retry to scan shortly after (12 seconds). I would suggest using this command on your device to ensure the anti-spam engine is not having further problems.

Log into the CLI > antispamupdate ironport force

Once done, it should take 5-10minutes (depending on network bandwidth) and the system will update and install a fresh CASE (antispam) engine on the device.

Your additional query, For filters to check what caused the match, you can use the filter action "Add Log Entry" then use the variable ->  $MatchedContent

This will show what was matched  from the email to your associated condition of the filter.

If you wish to know what spam rules caught an email, this information we're not able to share.

I hope this helps.

Matthew