MTA Live Monitoring does not work properly after upgrade

Support Center > Search Results > SecureKnowledge Details

Technical Level

Solution ID	sk166997
Technical Level
Product	SmartEvent / Eventia Analyzer, SmartLog, SmartReporter / Eventia Reporter
Version	R80.10, R80.20, R80.30, R80.40
OS	Gaia
Date Created	25-May-2020
Last Modified	05-Jul-2020

Symptoms

After upgrade, the MTA Live Monitoring only partially reports the emails with status "Scan Started", while all the emails are logged correctly from the RAW log and Smartlog index.
The $CPDIR/log/solr.log file shows:

...scan_started=2020-05-07T19:27:23Z, scan_ended=2020-05-07T19:27:23Z, email_status=Scan Ended, status_update=2020-05-07T19:27:23Z, email_content=Links, original_queue_id=49J3Pj66DkzlHhQ, type=Log, product=MTA ...... SolrException: ERROR: [doc=6302ceee-62e4-2a0f-88e2-8b9718f49c4b] multiple values encountered for non multiValued field file_size: [43081, 0] .... DATE TIME,PID ERROR [qtp1506885426-335160] org.apache.solr.core.SolrCore.finish:73 - [1] errors found for message [ERROR: [doc=6302ceee-62e4-2a0f-88e2-8b9718f49c4b] multiple values encountered for non multiValued field file_size: [43081, 0]]

Cause

SOLR failed to index some of the MTA logs contains file_size in multiValued field.

Solution

Note: To view this solution you need to Sign In .