System Alarms

A content scanning engine is stuck. This alarm will display even in the event of a single engine being stuck while others are still processing correctly.

You are not able to manually clear this alarm. The alarm will be cleared when stuck engines are restarted or there is a proxy restart.

A content scanning engine was restarted.

The Gateway detected a failure while trying to download new updates. For online updates please check for connectivity issues. For offline updates please ensure the update disk is available to the system. See the Software Downloads log for more information.

Installation of a licensed module , such as an anti-virus scanner, has not been successful. Refer to the upgrade service log for more detailed information. You should also perform a connectivity test to check your connection to the upgrade server. When fixed, you may need to revalidate the license.

A license feature, such as the license required for an installed anti-virus scanner, has expired or is no longer available. Contact your reseller or Clearswift to renew your license.

A log file in /var/log/cs-gateway or /var/log is bigger than 50 MB. This alarm condition can arise if a system service is repeatedly recording warning or error messages in its daily log file.

The Avira anti-virus service is not running. This is usually a short-lived alarm condition, and is cleared when the next system status check occurs. See Managing Services for more information. This alarm is only displayed if you have licensed and enabled the Avira anti-virus feature.

Conditions that can trigger this alarm are:

• Anti-virus definition updates.
• Configuration deployments.
• Gateway reboots.
• System upgrades.
• The service was terminated from the command line.

Avira anti-virus definitions have failed to be updated.

A log file in /var/msw/logs is bigger than 100 MB. This alarm condition can arise if a system service is repeatedly recording warning or error messages in its daily log file. It could also occur if the Web Proxy Log Level has been set at a high log level for an extended period of time.

CPU idle is 2% or less for a sustained period. The system cancels the alarm when CPU idle increases to 7% or more for a sustained period. Ignore this alarm unless it persists for more than ten minutes. Conditions that can trigger this alarm are:

• The overnight Database purge.
• System service startup.
• System upgrade or rollback.
• Abnormal system behavior.

Occupied disk space has reached 95% or more for a sustained period. The system cancels the alarm when disk space drops to 92% or less for a sustained period.  The alarm description may also include (main) or (data).

• (main) indicates that the root disk partition is running out of space.
• (data) indicates that the /var disk partition is running out of space.

Occupied disk space has reached 85% or more for a sustained period. The system cancels the alarm when disk space drops to 82% or less for a sustained period.  The alarm description may also include (main) or (data).

• (main) indicates that the root disk partition is running out of space.
• (data) indicates that the /var disk partition is running out of space. The most likely reason for low disk space is a very large number of messages held in message areas.

If the download of the revocation list fails more than 5 times in a row, this alarm is raised. The Infrastructure Service refreshes this list 15 minutes after start up then every 24 hours after. This alarm can be cleared manually, but will also clear if the download succeeds. For more information on the Infrastructure log refer to Logs.

The LDAP Agent has failed to update an LDAP synchronized User List. See the LDAP Agent log for more information.

The Web Gateway has failed to clear (or reset) the certificateA digital means of proving your identity. When you send a digitally-signed message, you are sending your certificate and public key. Certificates are issued by a certification authority and can expire or be revoked. cache. This alarm is automatically cleared following a subsequent successful reset the next day. If the alarm remains raised for more than 2 days, please contact Clearswift Support to resolve the issue.

The Gateway Reporter has failed to access a Peer Gateway to transfer the Web Audit Logs.

Conditions that can trigger this alarm are:

• Network problems.
• The Peer Gateway has changed its administration password.
• The Peer Gateway has been taken out of service.
• The Peer Gateway and Gateway Reporter are not the same version.

The LDAP Agent has failed to update an LDAP Synchronized Address List. See the LDAP Agent log for more information.

A disk error has occurred. This may be a temporary condition. For example, a disk has been removed. However, it may indicate issues with the disk controller or hardware. More information about the error is included in the alarm description shown on the user interface.

A hardware event has occurred. See the Hardware Event Log for more details.

A temperature-related hardware event has occurred.

The Health and Statistic Gatherer Service is not running. This is usually a short-lived alarm condition, and is cleared when the next system status check occurs. Ignore this alarm unless it persists for several minutes. See Managing Services for more information.

Conditions that can trigger this alarm are:

• The service has crashed.
• Gateway re-boots.
• The service was terminated from the command line.

The Infrastructure Service is not running. This is usually a short-lived alarm condition, and is cleared when the next system status check occurs. Ignore this alarm unless it persists for several minutes. See Managing Services for more information.

Conditions that can trigger this alarm are:

• The service has crashed.
• Gateway re-boots.
• The service was terminated from the command line.

The Kaspersky Service is not running. This is usually a short-lived alarm condition, and is cleared when the next system status check occurs. See Managing Services for more information.

Conditions that can trigger this alarm are:

• Anti-virus definition updates.
• Configuration deployments.
• Gateway re-boots.
• System upgrades
• The service was terminated from the command line.

The Kaspersky anti-virus definitions have failed to be updated.

The alarm is raised when a disabled key or certificate has been added to the Certificate Store to allow the administrator to inspect the key and make a decision about the action to take, for example, enable the key, or, if the key is untrusted, either delete the key, or leave it disabled. The disadvantage of deleting an untrusted key instead of leaving it disabled, is that it could be added to the store again in the future, resulting in the administrator being alerted again. If the administrator clears this alarm, it will remain clear until the next time a disabled key is added to the Certificate Store. The alarm is automatically cleared if there are no disabled keys in the Certificate Store.

The LDAP Synchronization Service has failed. See the LDAP Log for details.

The SMTP Alert Transport is not running. This is usually a short-lived alarm condition, and is cleared when the next system status check occurs. Ignore this alarm unless it persists for several minutes. See Managing Services for more information.

Conditions that can trigger this alarm are:

• The service has crashed.
• Gateway re-boots.
• The service was terminated from the command line.

The managed list download has failed. Conditions that can trigger this alarm are:

• The download site cannot be accessed.
• A validation failure has occurred on an individual managed list.

Memory usage has reached 97% or more for a sustained period. The system cancels the alarm when memory usage drops to 94% or less for a sustained period.

Memory usage has reached 90% or more for a sustained period. The system cancels the alarm when memory usage drops to 87% or less for a sustained period.

An LEQ file (the Data Set used by Lexical Expression Qualifiers) requires updating before it can be imported to your Gateway as it was created using a less-secure ffcreate process.

Use the command ffcreate -h to display the version number, and further help information.

To upgrade, we recommend visiting the Clearswift Support Portal and downloading the latest version of ffcreate, currently ffcreate480.zip.

The Lexical Data Import process has failed to import an LEQ file (Data Set). Check the Infrastructure log for further information.

See the Web Proxy Events Log.

An exception has occurred while purging the Web Audit database or while trying to publish data to the database.

The service which checks spam reputations on incoming traffic is disconnected from your Gateway. Run a connectivity test to check your HTTP connection or wait for the service to respond.

The service which downloads spam reputation updates has failed or is disconnected from your Gateway. Run a connectivity test to check your HTTP connection or wait for the service to respond.

The daily CRL download has failed indicating a firewall or HTTP proxy issue.

The Watchdog Service is not running. This is usually a short-lived alarm condition, and is cleared when the next system status check occurs. Ignore this alarm unless it persists for several minutes. See Managing Services for more information.

Conditions that can trigger this alarm are:

• Gateway re-boots.
• The service has crashed.
• The service was terminated from the command line.

The Sophos anti-virus service is not running. This is usually a short-lived alarm condition, and is cleared when the next system status check occurs. See Managing Services for more information. This alarm is only displayed if you have licensed and enabled the Sophos anti-virus feature.

Conditions that can trigger this alarm are:

• Anti-virus definition updates.
• Configuration deployments.
• Gateway re-boots.
• System upgrades.
• The service was terminated from the command line.

Sophos anti-virus definitions have failed to be updated.

The database is not running. Conditions that can trigger this alarm are:

• The database was stopped from the command line.
• The database failed to initialise.

The Gateway has failed to connect to the external server hosting your exported system logs.

The URL databases consist of:

• The Caic URL database is out of date.
• The Malware URL database is out of date.
• The Phishing URL database is out of date.

The license required to access the URL database has expired.

The directory /var/msw/proxy/diagnostics contains more than 250 MB of data. This directory is used to hold files produced when the Web Proxy Diagnostic Port is enabled.

The directory /var/msw/proxy/requests contains more than 2GB of data. This directory is used to store information about each request handled by the proxy, provided Proxy Request Logging has been enabled.

The Upgrade Service has failed to apply an update. See the Upgrade Service log for more information. See Viewing Gateway Logs .

This alarm is raised to alert the administrator that an update for the Clearswift Gateway has been downloaded and is ready to be applied. See Software Version and Upgrades for details.

The alarm clears itself once the update has been applied. However a subsequent update may then be downloaded, which will result in the alarm being raised again.

The software has not been fully upgraded.

The Web Proxy Service failed to load the URL database. Restarting the Web Proxy Service is recommended.

The User Authentication Service is not running. This is usually a short-lived alarm condition, and is usually cleared when the next system status check occurs. Ignore this alarm unless it persists for several minutes. See Managing Services for more information.

The User Interface Service is not running. This is usually a short-lived alarm condition, and is cleared when the next system status check occurs. Ignore this alarm unless it persists for several minutes. See Managing Services for more information.

Conditions that can trigger this alarm are:

• Gateway re-boots.
• The service has crashed.
• The service was terminated from the command line.

The Web Auditor Service is not running. This is usually a short-lived alarm condition, and is cleared when the next system status check occurs. Ignore this alarm unless it persists for several minutes. See Managing Services for more information.

Conditions that can trigger this alarm are:

• Gateway re-boots.
• The service has crashed.
• The service was stopped from the command line.

The Web Proxy Service is not running. This is usually a short-lived alarm condition, and is cleared when the next system status check occurs. Ignore this alarm unless it persists for several minutes. See Managing Services for more information.

Conditions that can trigger this alarm are:

• Gateway re-boots.
• The service has crashed.
• The service was stopped from the command line.