SonicWALL E-Mail-Security AntiSpam Troubleshooting & Firmware

If you are using SonicWALL E-Mail-Security as your antispam solution there are some useful ways to troubleshoot issues using different logs. They help to understand what happend to a certain mail, why communication to another mailserver is slow/lost and how the SNWL E-Mail-Security or your ES Remote Analyzers work internally.
These logs contain very sensible information in terms of privacy, make sure your data protection & legal processes are fully in place.

1. Which firmware to use?

SonicWALL uses the SNWL E-Mail-Security themselfs. The version of the used SonicWALL E-Mail-Security is written in their SMTP Banner:

1. DNS-Query to find MX-Records:
   > set q=mx
   > sonicwall.com
   Server:  dns9.quad9.net
   Address:  9.9.9.9
   
   Non-authoritative answer:
   sonicwall.com   MX preference = 15, mail exchanger = mail1.sonicwall.com
   sonicwall.com   MX preference = 15, mail exchanger = mail3.sonicwall.com
   sonicwall.com   MX preference = 15, mail exchanger = mail2.sonicwall.com
   
   
2. Connecting to them using a TCP-Session on TCP-Port 25 (e.g. telnet 25 or nc -C 25):
   nc -C mail1.sonicwall.com 25
   220 mail.sonicwall.com ESMTP SonicWall (9.1.2.3763)
   220 mail.sonicwall.com ESMTP SonicWall (9.1.1.3121)
   220 mail.sonicwall.com ESMTP SonicWall (9.1.2.3761)

There you can see which firmware SonicWALL themselfs are using.

2. Audit log

Use the audit log. It helps you most of the time and is very easy to understand.

3. Log level

Set the loglevel to "level 2" or "debug". That gerenates a lot of logs, but is necessary for fully troubleshooting mail-problems, either with other or your own mailservers or with mails "lost" in antispam.

1. Login to the SonicWall and navigate to Manage -> Anti-Spam -> Advanced Settings
   
2. Now select the Log Level 2 and then select the Type of Log file and then click on Download. We have chosen MlfAsgSMTP in the screenshot shown below to download the SMTP Logs, however depending on the issue the desired log files may be selected.
   
3. Save the logs in the desired location.
   Source: https://www.sonicwall.com/support/knowledge-base/how-to-obtain-smtp-logs-from-anti-spam/170503798824694/

You can use the CLI to adjust the maximum log filesize:

Logfile names:
Some log file names, such as those found in the commonlogs directory, contain a two-digit number such as 12.log. The "12" indicates that the log is for the 12th day of the most recent month. Some log file names end with a digit, such as MlfThumbUpdate_2.log. The "2" indicates that this is an older log. The current log is MlfThumbUpdate.log. The next most recent log is MlfThumbUpdate_0.log, followed by MlfThumbUpdate_1.log, and so forth.

The following logs are very useful:

• pmta:logs
• logs:MlfAsgSMTP
• logs:smtp

Use the timestamp, unique-message-id or the destination-address in order to follow a mail. Sometimes the E-Mail-Security sends a mail to localhost on another internal tcp socket. You can see that, because the destination is 127.0.0.1:*highport*. Because sometimes an action is done while the second inspection time, you need to follow that session, which will be documented in the logs, too.