topic Re: R80.20 MTA Monitoring in Firewall and Security Management

R80.20 MTA Monitoring

Charris_Lappas — Tue, 20 Nov 2018 17:32:11 GMT

Dear community,

It was published that with the release of R80.20 it should be a better way to monitor the MTA email processed and so on. Can you assist on an SK or provide some instructions?

Thanks,

Charris Lappas

Re: R80.20 MTA Monitoring

PhoneBoy — Tue, 20 Nov 2018 21:02:00 GMT

Maybe start with this thread: https://community.checkpoint.com/community/threat-prevention/blog/2018/11/20/mta-r8020

Re: R80.20 MTA Monitoring

Charris_Lappas — Tue, 20 Nov 2018 21:46:03 GMT

Unfortunately on my case both the logs and smart views are blank even though my MTA is running for some time now.

Re: R80.20 MTA Monitoring

PhoneBoy — Tue, 20 Nov 2018 21:57:27 GMT

Is it showing no logs at all or just no logs related to MTA?

If it's just no information about the MTA, the following SK might be helpful in debugging: ATRG: Mail Transfer Agent (MTA)

Re: R80.20 MTA Monitoring

Gad_Naveh — Wed, 21 Nov 2018 06:51:48 GMT

The new MTA SK:

Mail Transfer Agent Update - What's New

Re: R80.20 MTA Monitoring

Thomas_Werner — Wed, 21 Nov 2018 14:12:30 GMT

Hi Chris,

so here is a short summary what you get with R80.20 in regards to MTA logs and interaction.

1) MTA Logs

Within your logs you now get Postfix logs in the GUI - just filter for blade:MTA

You can see mail queue ID and even the E-Mail headers in the log.

Also it is possible to see all logs tied to an email by setting the "Original Queue ID" as a filter:

In the sample above yoou can see that the email logged as MTA log also created a TE log.

2) MTA Monitoring

You get new Views in SmartEvent.

a) MTA Overview

General statistics about mail processing. Note that almost all graphs are clickable to drill-down to the relevant logs:

b) MTA Live Monitoring

Here you can get a live view and statistics about your MTA queue. You can even manipulate items in the Postfix queue:

c) MTA Troubleshooting

Troubleshoot errors that appeared while processing emails:

Again you can drill-down by clicking the graphs/items:

Regards Thomas

Re: R80.20 MTA Monitoring

18568 — Wed, 21 Nov 2018 17:32:10 GMT

I take the opportunity to ask what is the "MTA admin quarantine support" feature (in EA) listed in the new MTA SK, how is this quarantine managed?

Re: R80.20 MTA Monitoring

Christian_Sandb — Wed, 21 Nov 2018 21:13:12 GMT

Hi Benjamin,

The quarantine support is managed the same way as MTA monitoring/troubleshooting using views in SmartEvent where you can find details and also release/deliver the email.

We are looking for EA installations so please contact your local Check Point team to get access to the required updates.

Rgds,

Christian