R80.20 MTA Monitoring

[Charris_Lappas]

Dear community,

It was published that with the release of R80.20 it should be a better way to monitor the MTA email processed and so on. Can you assist on an SK or provide some instructions?

Thanks,

Charris Lappas

[PhoneBoy]

Maybe start with this thread: https://community.checkpoint.com/community/threat-prevention/blog/2018/11/20/mta-r8020 

[Charris_Lappas]

Unfortunately on my case both the logs and smart views are blank even though my MTA is running for some time now. 

[PhoneBoy]

Is it showing no logs at all or just no logs related to MTA?

If it's just no information about the MTA, the following SK might be helpful in debugging: ATRG: Mail Transfer Agent (MTA) 

[Gad_Naveh]

The new MTA SK:

Mail Transfer Agent Update - What's New 

[Thomas_Werner]

Hi Chris,

so here is a short summary what you get with R80.20 in regards to MTA logs and interaction.

1) MTA Logs

Within your logs you now get Postfix logs in the GUI - just filter for blade:MTA

You can see mail queue ID and even the E-Mail headers in the log.

Also it is possible to see all logs tied to an email by setting the "Original Queue ID" as a filter:

In the sample above yoou can see that the email logged as MTA log also created a TE log.

2) MTA Monitoring

You get new Views in SmartEvent.

a)  MTA Overview

General statistics about mail processing. Note that almost all graphs are clickable to drill-down to the relevant logs:

b) MTA Live Monitoring

Here you can get a live view and statistics about your MTA queue. You can even manipulate items in the Postfix queue:

c)  MTA  Troubleshooting

Troubleshoot errors that appeared while processing emails:

Again you can drill-down by clicking the graphs/items:

Regards Thomas

[18568]

I take the opportunity to ask what is the "MTA admin quarantine support" feature (in EA) listed in the new MTA SK, how is this quarantine managed?

[Christian_Sandb]

Hi Benjamin,

The quarantine support is managed the same way as MTA monitoring/troubleshooting using views in SmartEvent where you can find details and also release/deliver the email.

We are looking for EA installations so please contact your local Check Point team to get access to the required updates.

Rgds,

Christian