Cisco Email Security Appliance 9.1.0-032 and above with URL Filtering.
Outgoing and incoming internet mails are delivered with a delay. Workqueue command shows up to 5000 mails in the queue.
If you track the messages you noticed that there are 20-25 minutes difference between the mail accepted action and policy apply action. Mails waits for approx 20 minutes but as soon as incoming mail policy applies, it is delivered in few seconds. No disk, RAM, or CPU performance issues on ESA.
A bug in URL Reputation Cloud Service Feature. A change deployed in 4 April 2016 leads to the problem.
Field Notice: FN – 64111 – Cisco Email Security Appliances – Change in URL Reputation Feature Servers Requires Configuration Change in Order to Avoid Work Queue Backups
1- Connect ESA with SSH
2- Run websecurityadvancedconfig command
3- set threshold value for outstanding requests to 5 as stated in the link above. (default 50)
4- Don’t change and accepts other vaules.
5- Run Commit command.
6- Do the same on all ESA Hosts.