Messaging Gateway audit logs do not display rejected SMTP AUTH events

book

Article ID: 158224

calendar_today

Updated On:

Products

Messaging Gateway

Issue/Introduction

When Symantec Messaging Gateway (SMG) is configured to accept SMTP connections to the Authentication MTA on TCP port 587 and a connection fails to authenticate, an error is logged to the maillog but these events do not appear queries from the Status -> Message Audit Logs page.

maillog

2013 Mar  1 13:54:20 PST (err) ecelerity: [4236] sms_smtp_auth: sms_smtp_auth_execute line 630: Failed to get result for CheckSmtpAuthentication from DDS error: 10040.

Cause

 While the failed SMTP AUTH event is logged in the message audit logs (MAL), you cannot search for AUTH events from the control center Status -> Message Audit Logs page.

Resolution

This is a known issue and has been addressed in SMG 10.5.2. Please update when able.

The AUTH failure audit events may be searched from the SMG command line using the malquery command as follows:

vm-sbg> malquery -p 5h -e AUTH*fail

<malResults count="1">
        <message UID="0aa0f847-b7ef76d00000108c-04-5131237501b3">
                <events>
                        <event time="1362174860" name="AUTH">}ö¬uùc|fail</event>
                        <event time="1362174837" name="ACCEPT">10.160.248.70:47127</event>
                </events>
        </message>
        <avg_events_per_email>2</avg_events_per_email>
</malResults>