Ironport ESA application fault

Sometimes Ironport Email Security Appliance (ESA) will generate an application fault alert with minimal or totally useless information for us. Most of the time this alert can only be explained by TAC engineer. One of this app faults may look similar to the following:

An application fault occurred: (‘egg/quarantine_smtp.py send_xmetadata|592’, “<type ‘exceptions.TypeError’>”, “object of type ‘NoneType’ has no len()”, ‘[egg/smtp_client.py _message_loop|1494] [egg/smtp_client.py _safe_transmit|1353] [egg/quarantine_smtp.py _transmit_message|614] [egg/quarantine_smtp.py send_xmetadata|592]’)

This application fault is caused by a SPAM message that got stack in the quarantine queue. The following simple steps will clear this alert.

Components:
Cisco Ironport ESA: 8.5.5-280

First, we need to identify if this is the case by checking recipient host.

(Machine Ironport ESA)> showrecipients

Please select how you would like to show messages:

  1. By recipient host.
  2. By Envelope From address.
  3. All.

[1]> 1

Please enter the hostname for the messages you wish to show.

> the.cpq.host

Showing messages, please wait.

MID/     Bytes/   Sender/                 Subject

[RID]   [Atmps]   Recipient

1041667 55215     discounted_medications5@sibttk.net [SUSPICIOUS MESSAGE] [SPAM] Canadian Pharmacy Exclusive Mall. 17% Off..

We see one message pending so next step is to get rid of it.

(Machine Ironport ESA)> deleterecipients

Please select how you would like to delete messages:

  1. By recipient host.
  2. By Envelope From address.
  3. All.

[1]> 1

Please enter the hostname for the messages you wish to delete.

[]> the.cpq.host

Are you sure you want to delete all messages being delivered to “the.cpq.host”? [N]> Y

Deleting messages, please wait..

1 recipients deleted.

(Machine Ironport ESA)>

Now since the message is gone page fault alerts will stop.

Leave a reply:

Your email address will not be published.

Site Footer

Sliding Sidebar