Warning mail.mydomain.com: CASE update unsuccessful. This may be due to transient network

Today I receive email from Ironport C160

Here is the message:

Subject: Warning mail.mydomain.com: CASE update unsuccessful. This may be due to transient network

The Warning message is:

CASE update unsuccessful. This may be due to transient network or DNS issues, HTTP proxy configuration causing update transmission errors or unavailability of the configured download server. The specific error on the appliance for this failure is: Error transferring CASE update directory information 'http://downloads.ironport.com/as/case.ini': I/O error opening URL 'http://downloads.ironport.com/as/case.ini?version=7.1.1-012&model=C160&serial=A4BADBDF7264-CNQH5M1&t_version=3.0.0-031&e_version=3.0.0-031&has_vof=0&has_ipas=1&has_sbnp=1'

Version: 7.1.1-012
Serial Number: XXXXXXXXX-CNQH5M1
Timestamp: 10 Dec 2010 07:58:55 +0700

To learn more about alerts, please visit our Knowledge Base. In many
cases, you can find further information about this specific alert. Please
click the Knowledge Base link after logging into our Support Portal at:

https://supportportal.ironport.com/irppcnctr/srvcd?u=http://secure-support.soma.ironport.com/products/&sid=900002

If you desire further information, please contact your support provider.

To open a support request for this issue, access the IronPort C160
and issue the "supportrequest" command. The command sends an email with
diagnostic information directly to your IronPort support provider to
facilitate a rapid diagnosis of the problem.

Thank you.


This occurs because the connection from Ironport to download source is disconnected. If this happens to Ironport you should check your internet connection.

Spam Sample Detected on Ironport

Here is the sample of message tracking on Ironport. This sample show you message detected as spam.

23 Nov 2010 14:45:43 (GMT +07:00) Protocol SMTP interface Data 2 (IP x.x.x.x) on incoming connection (ICID 553215) from sender IP 202.72.55.143. Reverse DNS host rmail1016c.rakuten.co.jp verified yes.

23 Nov 2010 14:45:43 (GMT +07:00) (ICID 553215) ACCEPT sender group UNKNOWNLIST match sbrs[-1.0:10.0] SBRS 0.0

23 Nov 2010 14:45:43 (GMT +07:00) Start message 99994 on incoming connection (ICID 553215).

23 Nov 2010 14:45:43 (GMT +07:00) Message 99994 enqueued on incoming connection (ICID 553215) from 224379@rmailmf.rakuten.co.jp.

23 Nov 2010 14:45:44 (GMT +07:00) Message 99994 on incoming connection (ICID 553215) added recipient (user@domain.com).

23 Nov 2010 14:45:45 (GMT +07:00) Message 99994 contains message ID header 20101123074537.8b0ef2fe849@rmail110c.rakuten.co.jp.

23 Nov 2010 14:45:45 (GMT +07:00) Message 99994 original subject on injection: 【号外】｜メルマガ会員限定|割 \r\n 引率ＵＰ♪●セレカジざっくりニット素 \r\n 材タートルネックワンピやリンジーロー \r\n ハンご愛用ワンピも

23 Nov 2010 14:45:45 (GMT +07:00) Message 99994 (43449 bytes) from 224379@rmailmf.rakuten.co.jp ready.

23 Nov 2010 14:45:45 (GMT +07:00) Message 99994 matched per-recipient policy DEFAULT for inbound mail policies.

23 Nov 2010 14:45:45 (GMT +07:00) Message 99994 scanned by Anti-Spam engine: CASE. Interim verdict: Positive

23 Nov 2010 14:45:45 (GMT +07:00) Message 99994 scanned by Anti-Spam engine: CASE. Final verdict: Positive

23 Nov 2010 14:45:46 (GMT +07:00) Message 99994 quarantined to Policy. Content filter my_policy.

Tracking message on Ironport C160

If you have email problem and you need to track message on ironport C160 do the following steps:

1. Login to Ironport Web Console using authenticated user
2. Go to Monitor > Message Tracking.
3. Massage tracking page will display. In this page you can fill any necessary text to perform filter process on how message tracking you want to display.
4. Fill in text box Envelope Sender with appropriate condition (Is, Begin With or Contains)
5. Fill in text box Envelope Recipient with appropriate condition (Is, Begin With or Contains)
6. Fill in text box Subject with appropriate condition (Is, Begin With, Contains, or Is Empty)
7. Define range of time the message is received: Last day, Last Week or Custom Range.
8. Click on Search Button to view the log result depend on your filter setting

Checking Quarantine Mail on IronPort

If you use Ironport C160 as a spam filter in your office, you have to check Quarantine mail is there any needed mail stop by Ironport. To check quarantine mail you log in to Ironport as administrator user and then go to menu Monitor > Quarantine page.

On the Quarantine page you can find out the number of emails that go into quarantine. There are 4 types of quarantine they are quarantine spam, outbreaks, policy and viruses.

1. Spam quarantine is an incoming email from the internet because it includes categories of spam. Ironport analyze each incoming email, and categorize it as spam if they meet certain conditions.

2. Outbreaks. The virus outbreak Filters engine compares incoming messages with rules published Virus outbreak filters. Messages that match rules are assigned a threat level and That threat level is compared to the threat level threshold you set. That meet or exceed Messages That threshold are quarantined.

3. Policy. You can set its own policy for the incoming emails to be quarantined. For example, an email coming into your domain with a user name that is no longer working in your office.

4. Viruses. Emails that contain viruses, of course, must be blocked not to enter a user inbox as it can endanger your data and network. In order for an email that contains a virus can always be quarantined of course you should always update your antivirus.

To find out details quarantined email data that you must click on the type of quarantine you want to see. Suppose you want to see the detail of policy data, then you cklik on policy. Immediately quarantine emails detailed data from the policy settings will be displayed as a table of data consisting of the recipient, sender, email subject, schedule an exit and the size of the email. To view the message body of each email you click on the subject field. So Ironport will display the contents of the message body of the email address you choose.

Installing Ironport C160

Since the number of incoming spam messages to a user in our office, we decided to use a special anti-spam, because the existing anti-spam on Mdaemon not able to detect and block incoming spam.

Ironport C160 becomes our choice as the anti-spam that is used. The installation process is assisted by technical support from the supplier that is Metrodata. It did not take long to install Ironport in our office. On the first day of Staff Metrodata install Ironport while the second day of transferring basic knowledge of how to monitor email tracking, especially email messages coming into our office and how to create a rule-Content filters for additional rules that can be customized by our own.

The result is very good spam filter; almost all spam can be blocked so that spam emails do not enter to user inbox. All spam is quarantined by the Ironport for backup if there are occasional important emails is required that is not spam but blocked by the Ironport.

I tried making my own artificial filter content. Content filter that I made was to block and quarantine incoming email from yahoogroups mailing list for employees who have not worked in our office. Employees who are out are not doing unsubscribe to the mailing list so that email from yahoogroups still sent to the user.

Benefits of using Ironport:

1. Nearly 100% of the spam emails were blocked so that spam does not enter to user inbox.
2. Reduce spam email traffic so that bandwidth LAN traffic decreased due to spam.
3. Users to work more effectively because it does not deal with spam.
4. User's Inbox folder is more efficient because it does not store spam.
5. Web interface for monitoring emails on the Ironport is very easy to use.
6. There are charts that facilitate monitoring of email receipt.
7. Message tracking was recorded in the log is complete.