Phone Lines icon GFI Support Home

Articles in this section

See more

Troubleshooting the Anti-Spam Quarantine Webpage

Author: Dennis Chege Updated

Overview

The MailEssentials Quarantine is a central store, accessible from the Quarantine page, where all emails detected as spam or malware are retained pending further action by the administrator, email users, or the configured automated spam actions.

This article explains the various error messages that are related to the webpages associated with the Quarantine Store and their root causes.

Introduction

The Quarantine Store is accessed through the GFI MailEssentials > Quarantine node on the MailEssentials configuration UI, but this webpage can sometimes fail to load successfully when there is an internal fault and instead display an error message.

The causes for these internal faults are varied but some of the most common reasons include:

  1. Unregistered module libraries
  2. Quarantine store database is corrupted
  3. Client-side browser errors in the ASPX pages
  4. Approving emails already deleted by the retention policy. This can happen due to browser caching.

The next section provides an indicative list of some of the error codes that can be encountered related to the quarantine store web page:

Description

Main Page Errors (default.aspx)

The following are some of the error codes may be encountered when there is a fault with the Quarantine store main page (default.aspx) or a corrupted Quarantine store database:

  • D8 or D9 - Cannot obtain IQuar object (due to an issue with Remoting/ME services not started)
  • D10 – JetExceptionDBCorrupt (corrupt quarantine store database)

Search Results Page (quarresult.aspx)

  • Q8 – Item failed to be approved by the quarantine system (due to an internal error or item not in quarantine system)
  • Q10 – Item failed to be deleted (due to an internal error or item not in quarantine system)
  • Q14 – Cannot obtain IQuar object (due to an issue with Remoting/ME services not started) 

Preview Page (preview.aspx)

  • P2 – Item failed to be deleted (due to an internal error or item not in quarantine system)
  • P4 – Item failed to be approved by the quarantine system [ApprovaAll] (due to an internal error or item not in quarantine system)
  • P11 – Item failed to be approved and whitelisted by the quarantine system (due to an internal error or item not in quarantine system)
  • P14 – Item details not found in session (due to expired session)
  • P16 - Cannot obtain IQuar object (due to an issue with Remoting/ME services not started)
  • P17 / P18 / P19 – QuarItemProps is null (due to item not in quarantine store)

Additionally, you can also examine the following Quarantine debug logs for more details on the encountered errors:

  • ActionServices\debuglogs\
    • QAPlugin.log
      • Logs of the action plugin that sends emails to quarantine
  • Backend\debuglogs\
    • QSS.log
      • Additions/Deletions from the malware quarantine
    • QSSOrphanCleanup.log
      • Check for orphaned entries and delete them in the malware quarantine
    • QSSItemsDalFb.log
      • Item parts being quarantined
    • QSSMSecPlugin.log
      • Malware Quarantine module
    • QSSRawDataDalFBF.log
      • Raw data logging for the malware quarantine
    • Quar.log
      • Additions/Deletions from the spam quarantine
    • QuarDigest.log
      • Digest logging

Recommendations to mitigate Quarantine webpage issues

Depending on the root cause identified, the resolution will usually involve restarting the GFI MailEssentials Attendant Service or repairing the Quarantine Store as described in this linked article: Repairing a Corrupted Quarantine Store or Greylist database

The following additional mitigation actions may also be necessary:

  • If the Quarantine store is too large, IIS may time out and block access to the Configuration Console webpage – a workaround is to change to Local mode when this happens
  • If the Quarantine store is growing too fast check the following:
    • Spam – check that Directory Harvesting filter is not set to Quarantine
    • Malware – check Directory Harvesting is in SMTP mode or enable Nonexistent Recipients
      • May need to create a rule to block large emails if Exchange/SMTP connectors are set to high
  • Quarantine Corruption
  • Digests not sent out
    • Pickup/Replay paths not set properly, usually happens after an upgrade
    • Quarantine URL in Switchboard not set

Related Articles

Back to top

Related articles