Best practices - Working with the Error Handler

Configure a general fail-open strategy

Configure a general fail-open strategy to let processing continue after any processing error that occurs.

1. Select Policy | Rule Sets.
2. Select Error Handler and expand the Default error handling rule set.
3. For all rules in the nested rule sets:
   1. Select a rule and click Edit for this rule.
   2. In the Edit Rule window, select Action, then select Continue as the rule action.
   3. Click Finish.
4. Click Save Changes.

Processing of requests that users send to the web now continues on Web Gateway even when errors occur.

Configure a fail-open strategy with a notification

Configure a fail-open strategy with a notification to notify the administrator or another recipient when a particular error has occurred.

For the notification, you add an event to a rule that handles a particular error.

1. Locate an existing rule:
   1. Select Policy | Rule Sets.
   2. Select Error Handler and expand the Default error handling rule set.
   3. Select a nested rule set, for example, Block on Anti-Malware Engine Errors. Then select one of its rules, for example, Block if anti-malware engine is overloaded, and click Edit for this rule.
2. In the Edit Rule window, select Action, then select Stop Rule Set as the rule action instead of Block.
3. Configure an event for notifying someone:
   1. Select Events and click Add.
   2. Select Event, then select Email.Send and click Parameters
   3. Type values for the three string parameters, for example, as follows:
      • Recipient (an email address): anyrecipient@samplecompany.com
        To configure more recipients, add their email addresses, separated by semicolons.
      • Subject (message name): Anti-Malware Overload
      • Body (message text): The anti-malware engines are overloaded, please inspect the mwg-antimalware-errors-log for more information.
   4. Click OK twice, then click Finish.
4. Click Save Changes.

When the error that is handled by this rule occurs, a notification is sent to the configured recipient. You can also configure multiple notification events for different recipients with varying message texts.

Configure a fail-open strategy for user groups

Configure a fail-open strategy with a notification that is only sent for errors with processing requests from users belonging to a particular user group.

1. Locate the rule that you configured a fail-open strategy with a notification for:
   1. Select Policy | Rule Sets.
   2. Select Error Handler and expand the Default error handling rule set.
   3. Select the Block on Anti-Malware Engine Errors nested rule set, then select the Block if anti-malware engine is overloaded rule and click Edit for this rule.
2. Configure an additional part for the rule criteria:
   1. In the Edit Rule window, select Rule Criteria, then select the criteria of the rule and click Add.
   2. Select User/Group criteria, then select:
      • Authentication.UserGroups as the property
      • at least one in list as the operator
   3. At the bottom of the right column, click Add List of String to add a list of user groups, and in the Add List window:
      • Name the list Groups to bypass on anti-malware overloads, then click OK.
      • Click Edit List and under List content, add the following string to the list (without quotes): Executives, then click OK twice.
   4. In the Edit Rule window, select AND as the Boolean operator for this additional criteria part, then click Finish.
3. Click Save Changes.

When the error that is handled by this rule occurs, processing continues and a notification is sent to the configured recipient. It is only sent, however, if a user from the configured user group submitted the request that was processed when the error occurred.