Some messages, that you expect to see in quarantine, get stuck in the delivery queue

Article:TECH92626  |  Created: 2009-01-27  |  Updated: 2013-07-24  |  Article URL http://www.symantec.com/docs/TECH92626
Article Type
Technical Solution

Product(s)

Issue



Some messages that you expect to show-up in quarantine never make it to the quarantine. These messages get stuck in the delivery queue with "Cannot create a spam message in the database" error in BrightmailLog.log.

Symptoms
Some messages, that trigger a policy with quarantine action, never show-up in quarantine. These messages get stuck in the delivery queue, even though they are well below the message size limit for the quarantine. Message Tracking or Message Audit Logs (if enabled) show "Delivered To" as "None" and blank "Delivery Time".


You see the following error in BrightmailLog.log:

Feb 27 2009 10:09:31 [SmtpConsumer_0008_019] ERROR - Cannot create a spam message in the database.
com.brightmail.dl.DataAccessException: An unexpected database error has occurred. Please contact your system administrator. ; nested exception is:
com.mysql.jdbc.PacketTooBigException: Packet for query is too large (17055899 > 16776192). You can change this value on the server by setting the max_allowed_packet' variable.

On the Brightmail Gateway Appliance and on SMSSMTP 5.x under Unix platform, you see the following log entry in maillog at INFO level:

2009 Feb 27 10:09:31 PST (info) delivery-mta/smtp[947]: 8D46B70C437: to=, relay=10.160.248.31[10.160.248.31], delay=2, status=deferred (host 10.160.248.31[10.160.248.31] said: 421 Closing Connection (in reply to end of DATA command))


 


Cause



This issue is caused by encoding of the message before insertion into the quarantine which results in an increase in the size of the message beyond the configured maximum message size limit for quarantine.


Solution



The issue of large messages becoming stuck in the delivery queue has been addressed with SBG version 8.0.0 and an NDR is sent to the original sender if the message size exceeds the configured maximum message size limit for the quarantine. Customers experiencing this issue with the Symantec Brightmail Gateway are encouraged up update to the latest software release.

SBG version 8.0 maillog entries:
2009 May  1 02:56:32 CDT (info) ecelerity: [18535] ML-DELIVERY_ATTEMPT: Message ID: 20/00-18535-E2BAAF94, Audit ID a9fe6464-b7bb6ae000004867-00-49faaaff1a3f, Delivery attempted, sender: jmartini@brightmail.com
2009 May  1 02:56:37 CDT (info) ecelerity: [18535] ML-PERMFAIL: Message ID: 20/00-18535-E2BAAF94, Audit ID a9fe6464-b7bb6ae000004867-00-49faaaff1a3f, Permanent delivery failure, sender: jmartini@brightmail.com, Detail: 554 Transaction failed


SBG version 8.0 BrightmailLog.log entries:
May 01 2009 02:47:08 [SmtpConsumer_0001_019] WARN - Rejected spam message (Audit ID = ).  Size (9593288 bytes) exceeds quarantine message size limit (1048576 bytes).



 


Supplemental Materials

Value37865

Legacy ID



2009022711253854


Article URL http://www.symantec.com/docs/TECH92626


Terms of use for this information are found in Legal Notices