Hi there, you are not alone. The issue started to happen after the upgrade to 12.5 and seems to mainly impact communication to and from MS domains.    Please open a ticket with TAC     Marc ... View more

Hi Cisco Community,   I wanted to share some of our experiences with IMS 12.1 latest.   We upgraded to IMS from traditional Ironport AntiSPAM during the 12.1 Beta program so we could compare effciency of the two engines between production and test.   In short IMS had a about 30% better crach rate for SPAM compared to traditional Ironport Antispam and during the ebat we had a very low level of false positives.   Well I can support teh statement that thigns have changed. We get about 4000 suspect SPAM messages per week and about 5-10% of them are false positives. We have tried to work with Cisco support to get them under better control but I am at a point now where I need answers:   a) What is the most common pattern why emails get triggered as suspected as I see none. b) What option can we sue in the threshold settings to make it less agressive without breaking the logic. All beta testing was requested with default settings so would need guidance from TALOS on what to change. c) Our previous Ironport AntiSOPAM settings have been even more agressive then default IMS but that would not work at all.   Happy to discuss with other impacted customers. We have uplaoded so far 200+ samples for correction.   -Marc ... View more

Scalability of VM   We run 24 vESA600 on VMWARE ESXi 6.5, and we still have days where out 6 inbound gateways can not keep up.   First make sure you DO NOT modify the settings requested by the deployment images (8/8 and 512 GB disk). Network adapter  still the dear old NE1000.   Make sure you apply the following three settings to your config to adapt timekeeping.   monitor_control.disable_tsc_offsetting=TRUE monitor_control.disable_rdtscopt_bt=TRUE timeTracker.forceMonotonicTTAT=TRUE   Make sure you check VMWARE HA settings.   Sizing the Cisco sizing guideline says a VESA600 should be able to handle 12-15 messages per second. We have seen cases as high as 30 per second and as low as 8 per second, depending on # of URL's and attachment types. If we get more then 90% of load for extended periods of time we just deploy two more ESA in our cluster and go from there. ... View more

Just in case you needed it :   index=email log_source="status_logs_splunk" | dedup gateway | sort gateway | table gateway , CPULoad , RAMUtil , DiskIO , ResourceConstraint, WorkQueueLength, MMLen, WorkQueueQuarantine, CurrentInboundConnections, CurrentOutboundConnections   The last variables are field extractions out of the status_logs. Gateway is a lookuptable IP address to gatewayname. Hope that helps. Maybe share your search querys. ... View more

The standard import file format is something like this :   [DEFAULT] table_tls = on_verify dane_option = off certificate = outboundcert.domain.com max_messages_per_connection = 50 recipient_minutes = 60 max_host_concurrency = 500 limit_type = host ip_sort_pref = REQUIRE_V4 limit_apply = VG send_tls_req_alert = on recipient_limit = 0 bounce_validation = off   [domain1.gov] recipient_minutes = 60 table_tls = require limit_apply = VG recipient_limit = 0 limit_type = host   [domain2.com] recipient_minutes = 60 table_tls = require limit_apply = VG recipient_limit = 0 limit_type = host   [domain3.com] recipient_minutes = 60 table_tls = require limit_apply = VG recipient_limit = 0 limit_type = host   etc   We copied the text blocks and just inserted the required domains into the list and have been able to move this list around accross test, QA and prod clusters.   I would also highly recommend to add both ESA servers to a cluster so that this step has only to be performed once per cluster. ... View more

We ran into similar issues with our customer facing domains a while back.   After verifying that all outbound message are correctly DKIM signed and the alignment is correct we did some further research. Having an older - even no longer officially required - SenderID DNS entry helped us overcome the issue for our outbound patient emails sent to Hotmail, Outlook, AOL and comcast.net to be classified as junk.   All those providers have a stricter validation policy.   Such a DNS record would just be a TXT record for your email domain with spf2.0/pra ?all as content.   Hope that helps you as well.   ... View more

we have an outstanding feature request for delivery-queue to be exposed in CLI, hopefully we will get it in V13. ... View more

I think that is the NFR software bundle Cisco offers for resellers. ... View more

Another, maybe much more basic way to monitor the workqueue are the follwing two options :   Option a)   System Administration System health Modify threshold for maximum messages in workqueue to a good number (100) we have 500   Add an email under Alerts and active Message Delivery as "Critical", edit the alerts settings to match your needs.   Option b)   Write a message filter on the CLI like :   CLIBasicMonitoringv1:    if workqueue-count > 100 {                                        notify ("admin@domain.com", "Workqueue Monitoring Alert");                                      }   Unless you pull the data from an external system via either syslog or the API you always have the possible limitation that your notification email might get stuck within the email queue. There si supposed to be dedicated task for this but we have seen this happenig in the past before we changed over to moniutor via Splunk.           ... View more

another approach is using syslog and a SIEM like Splunk, this gives us all the current and historical data but also allows for better alerts.   ... View more

Hi Mo,   maybe another idea :   a) we tag every email which is coming from external in the subject line with [EXTERNAL EMAIL] beside this we insert a red header to warn user not click on any unknown URLs included in such emails. b) emails which are sent by our service providers using our domain can come in and will not get tageed, assuming they pass all our authentication validations. c) email which use our domain but are not in our trusted list are identifed as [SPOOFED EMAIL]. We removed the from, replyto and sentby adress and replace it with env from. In addition we insert a header into each email and display the displayed FROM, REPLY and SENTBY. This allows to an internal user to see that an email came from badspoofer@publicmail.com even when the from name displayed was CEO@your company. In most cases and when a message is sent to our VIPs we deleted such emails at this stage.   Hope that helps.     ... View more

The best way I have found is to connect to the appliance via FTP.   Go into the status directory and download the status.log files. Import into Excel and analyse.     ... View more