How to troubleshoot when Symantec Email Submission Client (SESC) does not process email spam submissions

Products

• Mail Security for Microsoft Exchange
• Messaging Gateway

Issue/Introduction

 

Resolution

Email in a SESC-created folder is not processed and removed to the Deleted Items folder.

This article contains the steps to troubleshoot this issue.  It does not provide root cause analysis for why an item below may not be functioning.  If you locate error messages or event IDs that may indicate a potential problem use them to search in the knowledgebase for possible root causes.

• Check the SESC console for "failed" submissions.

1. Open the SESC console.  On the top of the screen is a Failed counter.  If this is non-zero the submissions may not be processed by the Symantec threat center.
2. Open the SESC debug log (default location is C:\Program Files\Symantec\SESC\1.0\Logs\log.txt) and look for errors.  An example of a submission error is the following:

[::]2012-05-02 09:12:29,154, [25], ERROR, Symantec.Submission.Common.HTTPClient.HttpPostRequest, Exception caught while getting HTTP response.
 Exception:

 System.Net.WebException: The remote server returned an error: (412) Precondition Failed.
   at System.Net.HttpWebRequest.GetResponse()
   at Symantec.Submission.Common.HTTPClient.HttpPostRequest.PostRequest()

3. If there are errors search the Symantec knowledgebase for errors relating to the message.

• Check the Windows Application Event log on the SESC computer for any errors from source Symantec Email Submission Client.
• Check the Windows Application Event log on the Exchange CAS server for any errors from source MSExchange Web Services.
• Check that the SESC service is running. See the following article for more details: Symantec Email Submission Client (SESC) does not process email when Windows service is stopped.

• Check that the SESC web site is running.

1. Open the IIS Manager control panel by using Start Menu|Internet Information Services (IIS) Manager.
2. Click on <server>|Sites in the Connections pane.
3. Ensure that the site Symantec Email Submission Client is in the Started status.

• Check that the SESC web site is accessible from the Exchange CAS server.

1. From the Exchange CAS server open a browser and go to this URL:

http://<sesccomputer>:8081/service.asmx

NOTE:  Replace <sesccomputer> with the name of the computer where SESC is installed.  The following is an example where SESC is installed on the computer with name sesccomp01-na:

http://sesccomp01-na:8081/service.asmx

IP addresses and fully qualified domain names are acceptable as well.

2. The browser may prompt for domain credentials.  Enter the SESC service account credentials.

See the attached screenshot for what the result should be.

• Check that SESC has an Exchange Web Services (EWS) subscription for the user.

Use the following article to view the subscriptions that SESC has: How to view Exchange Web Service (EWS) subscriptions created by Symantec Email Submission Client (SESC)

If SESC does not have a subscription for the user perform a system update.

1. Open the SESC console.
2. Open the System Update pane.
3. Select the appropriate Exchange servers from the Select Servers tree.
4. Click the Update button.

 

NOTE: The update process may take a long time.

 

• Check that the Exchange CAS server has a subscription for the user.

 See the following article for details and steps: Symantec Email Submission Client (SESC) does not process email spam submission after Exchange Client Access Server (CAS) reboot or iisreset.

 Environment

• SESC 1.X