Check Point Sandblast MTA

[bbruelhart]

We run two Sandblast MTA security gateways on version R80.30 for mail emulation. One is working fine, the second one never shows qemu-system-x86 when I look at "top". I therefore believe that the emulation is not working correctly.

When I check the statistics, the first one shows almost no errors, the second one shows the following statistics:

[Expert@ictsbap02:0]# tecli show statistics
Last day Last week Last 30 days

General Information:
--------------------
Scanned files: 195 6135 15797
Malicious files: 1 49 92
Files filtered by static analysis: 141(72%) 4627(75%) 11980(75%)
Files error count: 118 3796 10011
Files filtered by local cache: 52(26%) 1419(23%) 3615(22%)
Files no resource count: 0 0 0
Malicious files detected by HPS: 0 0 0
Files error count in HPS: 116 3675 9714
Average sample process time: 2 sec. 0 sec. 0 sec.
Average sample size: 476707 bytes 541175 bytes 552515 bytes

There are more than 50% errors. Does anyone have an idea what I can do so that the qemu-system-x86 would run and I would have less errors?

I appreciate your help on that.

[bbruelhart · Accepted solution]

This was a license issue. The license was not correct and did not include Threat Emulation. Since I added a eval license the Sandblast appliance is working correctly.