Guest

Preview Tool

Cisco Bug: CSCvu93899 - AMP logs incorrectly displays "The connection to the File Reputation Server was lost" generic error

Last Modified

Jul 20, 2020

Products (1)

  • Cisco Email Security Appliance

Known Affected Releases

13.5.1-277

Description (partial)

Symptom:
When checking the AMP logs in the ESA: 

GUI--> System Administration --> Log Subscription --> amp
CLI--> grep "was lost" amp

Example:
Mon Apr 31 15:15:15 2020 Info:   The attachment could not be scanned. File Name = '<namehere.extension>', MID = <12345>, SHA256 =<SHA256 string>, Unscannable Category = Service Not Available, Unscannable Reason = The connection to the File Reputation Server was lost

The log output shows the MID, file name and extension that triggered the alert.
When reviewing the MID in the Message Tracking, it displays additional log lines of how the attachments were handled correctly.

Example:

Message 12345 attachment 'namehere.7z' archive contents unpacked for processing
Message 12345 attachment 'filename' scanned by Advanced Malware Protection engine. File Disposition: Unknown
.
.
.
Message 12345 queued for delivery
Message 12345 Delivery Status: DELIVERED

Conditions:
ESA has valid AntiVirus, AntiSpam and AMP feature keys

AMP feature is configured correctly and connecting successfully to the File Analysis and File Reputation servers.
Bug details contain sensitive information and therefore require a Cisco.com account to be viewed.

Bug Details Include

  • Full Description (including symptoms, conditions and workarounds)
  • Status
  • Severity
  • Known Fixed Releases
  • Related Community Discussions
  • Number of Related Support Cases
Bug information is viewable for customers and partners who have a service contract. Registered users can view up to 200 bugs per month without a service contract.