Guest User!

You are not Sophos Staff.

Thread Info
  • State Suggested Answer
  • Locked Locked
  • Replies 5 replies
  • Answers 2 answers
  • Subscribers 28 subscribers
  • Views 12080 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

16.05.03 MR-3 no longer logging SMTP delivery to syslog

Joseph Gardner

Hello smart people,

I have an XG firewall that I have recently upgraded to 16.05.03 MR-3 and now have a strange situation. I send all my logs to a syslog-ng server, via syslog facility, which is then harvested and indexed with Splunk. Ever since the upgrade, it appears that SMTP delivered now no longer gets sent over the syslog facility. The DROPS from the Anti-Spam log type are all sent (I drop all spam and suspected spam), but none of the delivered (action ACCEPT). All other logging events seem to be going just fine, and the delivered emails are being logged to the local firewall logs. Its just the delivered that are no longer being sent over syslog.

I checked with a friend of mine, and he sees the exact same behavior after upgrading his to the same release. 

Has anyone else seen this behavior? All the configuration is the same as before with regards to logging, so it seems like a bug. Anywhere else I should look for advanced configurations or something?

 

Thanks!



This thread was automatically locked due to age.
Parents
  • 0

    Hi Joseph,

    we faced a similar issue, we had to rollback to SFOS 16.05.1-MR1 because on MR2 and MR3 email filter was misbehaving and emaisl were not delivered, also i couldn't see anything on mail log and it reported that the use of spam in disc (quarantine) was 0%. After each update i rebooted the firewall twice, MTA worked for a few hours well but after that it stoped. So we decied to rollback.

    In your case i would try to rollback the update and wait if there is any other solution.

     

    Regards.

Reply
  • 0

    Hi Joseph,

    we faced a similar issue, we had to rollback to SFOS 16.05.1-MR1 because on MR2 and MR3 email filter was misbehaving and emaisl were not delivered, also i couldn't see anything on mail log and it reported that the use of spam in disc (quarantine) was 0%. After each update i rebooted the firewall twice, MTA worked for a few hours well but after that it stoped. So we decied to rollback.

    In your case i would try to rollback the update and wait if there is any other solution.

     

    Regards.

Children
No Data