The message is either malformed or CASE is unable to process Error Message Troubleshooting on the ESA

Introduction

This document describes a critical message that is received on the Cisco Email Security Appliance (ESA) when it processes emails and the Cisco Anti-Spam Engine (CASE) is unable to scan them.

Problem

The ESA processes emails that the CASE is unable to scan, and the ESA presents this notification:

The Critical message is:
 
MID 124578 cannot be scanned by CASE. The message is either
 malformed or CASE is unable to process it at the moment.

Solution

This notification is caused by a corrupted email that has bad base64 encoding, or has corrupted Multi-Purpose Internet Mail Extensions (MIME) parts, and cannot be scanned properly by the CASE. The CASE itself works as designed, and this is not an indication of an overall processing issue on the appliance.

If you have an instance that you would like investigated, you must provide an RFC-822 copy of the message that is noted in the alert. Refer to the Create RFC-822 MIME Encoded Attachments on the ESA Cisco article for more details.