Troubleshooting Tip: Configuration for the 'UNSEEN' error in FortiMail’s log

If the error below is observed in the FortiMail’s cross-search log, it might be due to the duration of the FortiSandbox Scan timeout in the FortiMail being too short for the FortiSandbox to complete the file scanning and return the result to FortiMail:' Email [Session ID] is expired, 30 queries made, UNSEEN: File <File name>, 600s used'.

The issue may be encountered in the following scenarios:

• FortiSandbox tracer and rating engines update.
• FortiSandbox is busy with high-pending jobs.

In FortiMail, navigate to System -> FortiSandbox to configure the scan timeout to 30 minutes because 30 minutes is the recommended value for the FortiSandbox to complete the URL/File scanning.

Or via the CLI:

config system fortisandbox

    set scan-timeout
    <integer> timeout value before discarding unfinished scan tasks, 6 to 360 minutes, default 30 minutes

    --- current value ---
    scan-timeout: 15

    set scan-timeout 30

end