Many Email alerts received from CAS

Products

• Content Analysis Software

Issue/Introduction

Many CAS email alerts, about files being  un-scanned

Cause

In CAS alert delivery methods, if it is configured to send an email for file was passed through without being scanned, any file that is  un scanned on the CAS will trigger this alert email, and administrator might receive many alerts for such files.

This is configured under CAs management console, Services, AV scanning behavior, if the configuration is set to serve the file under any condition for example password protected files, or Maximum file size exceeded, for any file that is matching this criteria, the file will be served un scanned, and an alert email will be sent to the admin email, as configured on CAS SMTP setting.

 

Resolution

Email alerts for "File was passed through without being scanned "might need to be disabled, if this is causing huge amount of mails being sent to the administrator, and depend on normal logging options (Local logging on CAS, and SNMP alerts)