Thursday, November 6, 2008

Symantec Mail Security Conduit.exe hogs 100% cpu using 100 percent CPU

Symantec Mail Security

conduit.log
4 Nov 2008 16:03:52 (ERROR:4480.4012): [12093] Unable to process rule set.
4 Nov 2008 16:03:53 (ERROR:4480.4012): [12052] Unable to parse message.
4 Nov 2008 16:03:53 (ERROR:4480.4012): [12063] Cannot process 'Heuristic and URL Rules'.

Event Log:
Event Source: Symantec Mail Security for Microsoft Exchange
Event ID: 110
The process SAVFMSESp.exe failed to start (0xC009008A).
The process SAVFMSETask.exe was restarted.
The process SAVFMSETask.exe terminated unexpectedly.

Event Source: Symantec Mail Security for Microsoft Exchange
Event ID: 68
Unable to initialize Scan Engine. The virus definitions may be missing or corrupt. Perform a LiveUpdate to retrieve the latest virus defintions.

Method 1:
Clean old log files under:
D:\Program Files\Exchsrvr\MDBDATA

Clean BadMails under following path every week:
del /Q /S "D:\Program Files\Exchsrvr\Mailroot\vsi 1\BadMail"


Method 2:
The virus definitions may be missing or corrupt, so we copy the good virus definitions from another machine and overwrite it to the machine that has problem:
C:\Program Files\Common Files\Symantec Shared\*
C:\Program Files\Symantec\SMSMSE\6.0\Server\bm_ruleset*

Note: There is a License Folder under C:\Program Files\Common Files\Symantec Shared . Make sure you do not overwrite the license files. Make a backup before you do these steps.

No comments: