System Alarms

The Gateway detected a failure while trying to download new updates. For online updates please check for connectivity issues. For offline updates please ensure the update disk is available to the system. See the Software Downloads log for more information.

Installation of a licensed module , such as an anti-virus scanner, has not been successful. Refer to the upgrade service log for more detailed information. You should also perform a connectivity test to check your connection to the upgrade server. When fixed, you may need to revalidate the license.

A license feature, such as the license required for an installed anti-virus scanner, has expired or is no longer available. Contact your reseller or Clearswift to renew your license.

A log file in /var/log/cs-gateway or /var/log is bigger than 50 MB. This alarm condition can arise if a system service is repeatedly recording warning or error messages in its daily log file.

An Exchange Interceptor has attempted to access your Gateway. You should check the Exchange Message log for the identity of the Interceptor and configure your Gateway and Exchange Server accordingly.

The Avira anti-virus service is not running. This is usually a short-lived alarm condition, and is cleared when the next system status check occurs. See Managing Services for more information. This alarm is only displayed if you have licensed and enabled the Avira anti-virus feature.

Conditions that can trigger this alarm are:

• Anti-virus definition updates.
• Configuration deployments.
• Gateway reboots.
• System upgrades.
• The service was terminated from the command line.

Avira anti-virus definitions have failed to be updated.

This alarm relates to licenseable functionality; if you do not see this alarm, it may be because you have not licensed this feature.

This alarm relates to licenseable functionality; if you do not see this alarm, it may be because you have not licensed this feature.

CPU idle is 2% or less for a sustained period. The system cancels the alarm when CPU idle increases to 7% or more for a sustained period. Ignore this alarm unless it persists for more than ten minutes. Conditions that can trigger this alarm are:

• The overnight Database purge.
• System service startup.
• System upgrade or rollback.
• Abnormal system behavior.

Occupied disk space has reached 95% or more for a sustained period. The system cancels the alarm when disk space drops to 92% or less for a sustained period.  The alarm description may also include (main) or (data).

• (main) indicates that the root disk partition is running out of space.
• (data) indicates that the /var disk partition is running out of space.

Occupied disk space has reached 85% or more for a sustained period. The system cancels the alarm when disk space drops to 82% or less for a sustained period.  The alarm description may also include (main) or (data).

• (main) indicates that the root disk partition is running out of space.
• (data) indicates that the /var disk partition is running out of space. The most likely reason for low disk space is a very large number of messages held in message areas.

A problem has been encountered on the Exchange Server and will potentially prevent Exchange messages from being processed by your Gateway. See the Exchange Message log for details.

The Message Auditing Service has failed to add audit data to the database. See the Audit log for more information.

The Message Area Manager has failed to add a held message to the database. See the Infrastructure log for more information.

The Personal Message Management Service has failed to access a Peer Gateway to retrieve PMM information to consolidate. For more details see the PMM Infrastructure log. See Viewing Gateway Logs .

Conditions that can trigger this alarm are:

• Network problems.
• The Peer Gateway has changed its administration password.
• The Peer Gateway has been taken out of service.

The LDAP Agent has failed to update an LDAP Synchronized Address List. See the LDAP Agent log for more information.

A disk error has occurred. This may be a temporary condition. For example, a disk has been removed. However, it may indicate issues with the disk controller or hardware. More information about the error is included in the alarm description shown on the user interface.

A hardware event has occurred. See the Hardware Event Log for more details.

A temperature-related hardware event has occurred.

The Health and Statistic Gatherer Service is not running. This is usually a short-lived alarm condition, and is cleared when the next system status check occurs. Ignore this alarm unless it persists for several minutes. See Managing Services for more information.

Conditions that can trigger this alarm are:

• The service has crashed.
• Gateway re-boots.
• The service was terminated from the command line.

This alarm relates to licenseable functionality; if you do not see this alarm, it may be because you have not licensed this feature.

The Kaspersky Service is not running. This is usually a short-lived alarm condition, and is cleared when the next system status check occurs. See Managing Services for more information.

Conditions that can trigger this alarm are:

• Anti-virus definition updates.
• Configuration deployments.
• Gateway re-boots.
• System upgrades
• The service was terminated from the command line.

The Kaspersky anti-virus definitions have failed to be updated.

The LDAP Synchronization Service has failed. See the LDAP Log for details.

The managed list download has failed. Conditions that can trigger this alarm are:

• The download site cannot be accessed.
• A validation failure has occurred on an individual managed list.

Memory usage has reached 97% or more for a sustained period. The system cancels the alarm when memory usage drops to 94% or less for a sustained period.

Memory usage has reached 90% or more for a sustained period. The system cancels the alarm when memory usage drops to 87% or less for a sustained period.

The Message Area Manager service is not running. This is usually a short-lived alarm condition, and is cleared when the next system status check occurs. Ignore this alarm unless it persists for several minutes. See Managing Services for more information.

Conditions that can trigger this alarm are:

• Anti-virus definition updates.
• Configuration deployments.
• Gateway re-boots.
• System upgrades or rollbacks.
• The service was stopped from the command line.

The Message Auditing Service is not running. This is usually a short-lived alarm condition, and is cleared when the next system status check occurs. Ignore this alarm unless it persists for several minutes. See Managing Services for more information.

Conditions that can trigger this alarm are:

• Anti-virus definition updates.
• Configuration deployments.
• Gateway re-boots.
• System upgrades or rollbacks.
• The service was stopped from the command line.

An LEQ file (the Data Set used by Lexical Expression Qualifiers) requires updating before it can be imported to your Gateway as it was created using a less-secure ffcreate process.

Use the command ffcreate -h to display the version number, and further help information.

To upgrade, we recommend visiting the Clearswift Support Portal and downloading the latest version of ffcreate, currently ffcreate480.zip.

The Lexical Data Import process has failed to import an LEQ file (Data Set). Check the Infrastructure log for further information.

The PMM Service is not running. This is usually a short-lived alarm condition, and is cleared when the next system status check occurs. Ignore this alarm unless it persists for several minutes. See Managing Services for more information.

Conditions that can trigger this alarm are:

• Anti-virus definition updates.
• Configuration deployments.
• Gateway re-boots.
• System upgrades or rollbacks.
• The service was stopped from the command line.

An error has occurred with the policy engine.

The MIMEsweeper Policy Enforcement Service has failed to move a message between processing areas. See the Policy Enforcement log for more information.

The MIMEsweeper Policy Enforcement Service has failed to process a message. See the Policy Enforcement log for more information.  See Viewing Gateway Logs .

The failed message is moved into the Problem Messages Area and details of the message can be viewed from the Message Center. See Analyze and manage held messages.

These details should explain why the processing failure occurred. Conditions that can trigger this alarm are:

• A very large message exceeded the maximum processing time.
• A complex message part  exceeded the maximum recursive depth.
• A text message part contained binary data.
• A message part was badly formed and could not be decomposed.

The MIMEsweeper Policy Enforcement Service has detected problems that indicate that the service has become unreliable. See the Policy Enforcement log for more details. See Viewing Gateway Logs  .

If this alarm has triggered, the recommended action is to use the System Center Service Control page to restart the MIMEsweeper Policy Enforcement Service.

The Watchdog Service is not running. This is usually a short-lived alarm condition, and is cleared when the next system status check occurs. Ignore this alarm unless it persists for several minutes. See Managing Services for more information.

Conditions that can trigger this alarm are:

• Gateway re-boots.
• The service has crashed.
• System upgrades or rollbacks.
• The service was terminated from the command line.

The SMTP Alert Transport is not running. This is usually a short-lived alarm condition, and is cleared when the next system status check occurs. Ignore this alarm unless it persists for several minutes. See Managing Services for more information.

Conditions that can trigger this alarm are:

• Anti-virus definition updates.
• Configuration deployments.
• Gateway re-boots.
• System upgrades or rollbacks.
• The service was stopped from the command line.

The SMTP Inbound Transport Service is not running. This is usually a short-lived alarm condition, and is cleared when the next system status check occurs. Ignore this alarm unless it persists for several minutes. See Managing Services for more information.

Conditions that can trigger this alarm are:

• Anti-virus definition updates.
• Configuration deployments.
• Gateway re-boots.
• System upgrades or rollbacks.
• The service was stopped from the command line.

The SMTP Outbound Transport Service is not running. This is usually a short-lived alarm condition, and is cleared when the next system status check occurs. Ignore this alarm unless it persists for several minutes. See Managing Services for more information.

Conditions that can trigger this alarm are:

• Anti-virus definition updates.
• Configuration deployments.
• Gateway re-boots.
• System upgrades or rollbacks.
• The service was stopped from the command line.

The Sophos anti-virus service is not running. This is usually a short-lived alarm condition, and is cleared when the next system status check occurs. See Managing Services for more information. This alarm is only displayed if you have licensed and enabled the Sophos anti-virus feature.

Conditions that can trigger this alarm are:

• Anti-virus definition updates.
• Configuration deployments.
• Gateway re-boots.
• System upgrades.
• The service was terminated from the command line.

Sophos anti-virus definitions have failed to be updated.

The database is not running. Conditions that can trigger this alarm are:

• The database was stopped from the command line.
• The database failed to initialise.

The Gateway has failed to connect to the external server hosting your exported system logs.

There could be several reasons for this alarm. You should check the Exchange Message Transport Server log and make sure that the Interceptors are active. You should also check if there is any mail in the Interceptor queues that have been queued for a long time. If there are, it could indicate that the Interceptor is not getting results from the Gateway. If not, but the amount of mail is high, it might indicate that your Gateway has too many Exchange Servers sending mail to it.

By default, this alarm is triggered when 250 or more messages are waiting to be processed by the MIMEsweeper Policy Enforcement Service. The alarm is canceled when the number drops below 200. Conditions that can trigger this alarm are:

• The MIMEsweeper Policy Enforcement Service is not running, or has not been running.
• The MIMEsweeper Policy Enforcement Service has been processing very large messages.
• The CPU usage has been high for a sustained period.

The default values can be changes to suit your preference.

This alarm is raised to alert the administrator that an update for the Clearswift Gateway has been downloaded and is ready to be applied. See Software Version and Upgrades for details.

The alarm clears itself once the update has been applied. However a subsequent update may then be downloaded, which will result in the alarm being raised again.

The User Interface Service is not running. This is usually a short-lived alarm condition, and is cleared when the next system status check occurs. Ignore this alarm unless it persists for several minutes. See Managing Services for more information.

Conditions that can trigger this alarm are:

• Gateway re-boots.
• The service has crashed.
• The service was terminated from the command line.