Troubleshooting
Problem
Incoming email fails to be ingested into Incidents in IBM Security SOAR errors are generated:
FolderClosedIOException javax.mail.FolderClosedException
JavaMail Exception: java.net.SocketTimeoutException: Read timed out
Symptom
Incoming email is not processed by the server due to large number of messages.
Cause
This problem is caused by too many email messages being generated for the SOAR server to process. Throttling the email messages on the server could be used to work around the issue or making changes in the way email is processed by the SOAR server.
Environment
IBM Security SOAR configured for incoming mail that uses IMAP for email ingestion.
Diagnosing The Problem
Errors occur in the resilient-email.log when the mail server is not set to perform throttling on the IMAP connection.
FolderClosedIOException
javax.mail.FolderClosedException: * BYE JavaMail Exception: java.net.SocketTimeoutException: Read timed out
at com.sun.mail.imap.IMAPFolder.search(IMAPFolder.java:2433)
at org.apache.camel.component.mail.MailConsumer
Resolving The Problem
Solution:
1. Reduce email message read batch size:
Reduce from 10 to 2
/usr/share/co3/conf/email-server.properties
Change
resMaxBatchSize=10
to -> resMaxBatchSize=2
2. Reduce parallel processing of messages:
Set following config var using resutil command:
email_service.save_email_max_concurrent_consumers=1
sudo resutil configset -key email_service.save_email_max_concurrent_consumers -ivalue 1
Document Location
Worldwide
[{"Type":"MASTER","Line of Business":{"code":"LOB24","label":"Security Software"},"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Product":{"code":"SSIP9Q","label":"IBM Security SOAR"},"ARM Category":[{"code":"a8m0z000000cvv5AAA","label":"Email"}],"ARM Case Number":"TS005845552","Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"All Versions"}]
Was this topic helpful?
Document Information
Modified date:
11 August 2021
UID
ibm16478363