Technical Tip: Configuration for the 'UNSEEN' error in FortiMail’s log

[cysaw]

 

Description	This article provides the best configuration for the 'UNSEEN' error in FortiMail’s log.
Scope	FortiMail.
Solution	If the error below is observed in the FortiMail’s cross-search log, it might be due the duration of the FortiSandbox Scan timeout in the FortiMail being too short for the FortiSandbox to complete the file scanning and return the result to FortiMail:' Email [Session ID] is expired, 30 queries made, UNSEEN: File <File name>, 600s used'. Below are the scenarios for the issue: FortiSandbox tracer and rating engines update. FortiSandbox is busy with high-pending jobs. In FortiMail, navigate to System -> FortiSandbox to configure the scan timeout to 30 minutes because 30 minutes is the recommended value for the FortiSandbox to complete the URL/File scanning.