If the communication between SPC 2 and SMG is lost, report DB rows will truncate after 1,000,000 (one million) events have been cached on the SMG host.
The BrightmailLog.log will show the following message under Warning level:
Jan 20 2011 11:34:51 [BrightmailScheduler_Worker-2] WARN - the number of mail transfer events exceeded the maximum value of 1000000 events. deleted 32810 events.
Symantec Protection Center 2 queries the Messaging Gateway 9.5 database and extracts data every three minutes.
If communication is lost, Symantec Messaging Gateway continues writing reporting data to its internal database but that data is no longer extracted as expected.
When data hits 1,000,000 (one million) rows, Symantec Messaging Gateway truncates rows, starting with the oldest rows first. When communication is re-established, truncated data is not restored.
An error warning does not appear in the Messaging Gateway or Protection Center UI.
There are two ways to detect this:
1. Protection Center reports will not update with new data even after new query periods have elapsed.
2. The Messaging Gateway’s BrightmailLog.log will include a warning message like this:
Jan 20 2011 11:34:51 [BrightmailScheduler_Worker-2] WARN - the number of mail transfer events exceeded the maximum value of 1000000 events. deleted 32810
- Symantec Messaging Gateway 9.5
- Symantec Protection Center 2