Symantec Messaging Gateway bmserver Log Shows Unscannable Verdict for [unknown name]

Products

• Messaging Gateway

Issue/Introduction

• When message logging at NOTICE or higher for the bmserver, message with an attachment is scanned Symantec Messaging Gateway (SMG) and has [unknown name] in the bmserver log:

2011-11-11T14:53:27-08:00 (WARNING:4367.2114026384): [27226] Decomposition to deep (the message is deeper than the configured 5 levels).   2011-11-11T14:53:27-08:00 (NOTICE:4367.2114026384): [24126] Antivirus returns unscannable because decomposer maximum depth is reached with [unknown name].
 

To verify the logging level this follow these steps:
1. Login to the SMG Control Center Web UI
2. Click on Administration->Settings->Logs
3. In the Local Logging tab, the Brightmail Engine has the Local Log Levels set for NOTICE, INFORMATION, or DEBUG.

To locate the bmserver logs follow these steps:
1.  Login to the SMG Control Center Web UI 
2. Click on Status->System->Logs
3. In the Filter tool, select the affected SMG scanner in the Host drop-down box
4. In the Log Type, select Brightmail Engine Logs

• The MAL log shows the correct file names for the affected messages.  For example:

Message Data 
ID: 0aa0f256-b7fcf6d0000011a4-5c-4ebda75a3bcb
Message-ID:
Accepted From: 10.160.242.37
Scanners: Local Host 
Time accepted: Friday, Nov 11, 2011 02:53:14 PM PST
Direction: Inbound
Sender:[email protected]
Authenticated username: (none)
Original recipients:
[email protected] 
Original Subject: eleven_level
Full attachment list:
eleven_level.zip
Suspect attachments: None
 Recipient Data
Intended recipient:
[email protected] 

To use the Message Audit Logs to verify this condition, follow these steps:
1. Login to the SMG Brightmail Control Center Web UI
2. Click on Status->SMTP->Message Audit Logs
3. Use the Filter tool to search for and locate the affected message.

 

Cause

 The bmserver process is incorrectly listing the temporary filename of a scanned attachment for a e-mail message sent through the application.

Resolution

This is a benign error message and can be safely ignored.

This issue has been resolved as of SMG 9.5.4.  Please upgrade to the latest version to resolve this issue.