Cisco Bug: CSCvu93899 - AMP logs incorrectly displays "The connection to the File Reputation Server was lost" generic error
Jul 20, 2020
- Cisco Email Security Appliance
Known Affected Releases
Symptom: When checking the AMP logs in the ESA: GUI--> System Administration --> Log Subscription --> amp CLI--> grep "was lost" amp Example: Mon Apr 31 15:15:15 2020 Info: The attachment could not be scanned. File Name = '<namehere.extension>', MID = <12345>, SHA256 =<SHA256 string>, Unscannable Category = Service Not Available, Unscannable Reason = The connection to the File Reputation Server was lost The log output shows the MID, file name and extension that triggered the alert. When reviewing the MID in the Message Tracking, it displays additional log lines of how the attachments were handled correctly. Example: Message 12345 attachment 'namehere.7z' archive contents unpacked for processing Message 12345 attachment 'filename' scanned by Advanced Malware Protection engine. File Disposition: Unknown . . . Message 12345 queued for delivery Message 12345 Delivery Status: DELIVERED Conditions: ESA has valid AntiVirus, AntiSpam and AMP feature keys AMP feature is configured correctly and connecting successfully to the File Analysis and File Reputation servers.
Bug details contain sensitive information and therefore require a Cisco.com account to be viewed.
Bug Details Include
- Full Description (including symptoms, conditions and workarounds)
- Known Fixed Releases
- Related Community Discussions
- Number of Related Support Cases