How to find which Content Analysis Servers have most failures to process Threat Defense requests.

Products

• Messaging Gateway

Issue/Introduction

Need to narrowing down which CAS servers have issues processing requests. Message Audit Logs only show the successful CAS instance.

Environment

Messaging Gateway 10.7.3, 10.7.4

Cause

Availability and performance monitoring and troubleshooting.

Resolution

CAS connection related errors are logged into the bmiserver_log as ERROR and they start with "casoop:"

Timeouts are logged into Debug level logs because they can occur in legitimate cases and verdicts returned later or reused for the same files.

SMG 10.7.5 will be tentatively logging the timeouts as Notice Level logs.

Logging is set in the Control Center > Administration > Logs > Brightmail Engine (Errors|Warnings|Information|Notices|Debug)