Access Denied + savfmsp.exe restart + decompression errors

[distressed1]

Have recently started new job and as such have grim task sorting out errors where configurations done by others. Am new to the products.

Windows 2003 SBS with Exchange, Symantec Small Business Pack with Groupware, Veritas Back Up Exec.

Errors in Windows application log:

1. SAVFMSESp.exe restarted
2. Scan Engine Failure (0xC009007E) + many more
3. Decompression errors whilst scanning zipped archive files.

Antivirus errors - quarantine directory exceeded set limit (quarantine appears to be empty)

Also when backing up recently have multiple access denied errors on files (reckon theyre being locked by av)

These problems are gaining in frequency, suspect virus or virus definition file corrupted.

Has anyone come accross these errors - or offer an idea.

Thanks in Advance

Distressed

 

[dstcroix]

Hi Distressed, we are currently having the exact same issues here. I have contacted Symantec technical support and have been told to make sure of the following:

1) That all exclusions are properly set in the NAV client on the Exchange server(s)
2) That the VSAPI threads are the sufficient amount (the rule is 3 for 1 processor and 5 for 2)
3) That overlapping scans are not an issue
4) That if you have Live Update scheduled on your SAV client, you do not need to also have Mail Security do a Live Update as this could corrupt the file structure for Symantec (as it has in our case, and providing you have a SAV client also on your Exchange server)

Also, upgrading to 4.6.1 is recommended as there is an updated decompression engine involved and it apparently resolves still ongoing memory leak issues.

In regards to your Quarantine server, you'll probably need to specify purge dates and size limits on it. I also had the same problem with items alerting that they were in Quarantine, and yet not being able to physically view them. This one eventually corrected itself (I am not sure if a start and stop of IIS will alleviate this issue - ours just cleared up).

I hope this helps.

 

[distressed1]

Thanks 4 that.

Running Symantec 9.0 with AV for Groupware. Do yo know which exclusions to set up?

A search found the following list however don't have an M drive, use exchange 2003 and have no experience of exchange!. Are these set up in Symantec 9 or the the exchange Av.?


The M: drive. (Exchange 2000)
Exchange databases, logs and checkpoint files across all storage groups. By default, these are located in the Exchsrvr\Mdbdata folder.
Exchange MTA files in the Exchsrvr\Mtadata folder.
Directory Exchsrvr\server_name.log file which contains the tracking log.
The Exchsrvr\Mailroot virtual server folder.
The working folder that is used to store streaming temporary files that are used for message conversion. By default, this folder is located at \Exchsrvr\MDBData, but you can configure the location.
The temporary folder that is used for offline database maintenance with Eseutil.exe and Isinteg utilities.
Site Replication Service (SRS) files in the Exchsrvr\Srsdata folder.
Microsoft Internet Information Service (IIS) system files in the %SystemRoot%\System32\Inetsrv folder.
Note that the list refers to the default file locations and that in production environment some of those elements for example database and log files can be found in different locations.

 

[distressed1]

Configured the exceptions for scheduled scans as well as auto protect.

Error messages have subsided however - it is the weekend only Monday will tell.

Suspected live updates were corrupted and planned reinstall however fingers crossed won't need this.

Will upgrade to 4.6.1 as have memory issues too.

Thanks 4 Help

 

[dstcroix]

Anytime. I'm glad your exclusions went well. Have you also excluded the Mail Security Temp folder? That is also one that should be excluded.

Good luck!! Our error went down as well somewhat (at least no mail interruptions) but until we upgrade and configure the rest appropriately we may still have the same problems.

 

[darksasami]

Just to be sure, you guys, here's Symantec's full list of Stuff To Do On Exchange Servers.

http://service1.symantec.com/SUPPORT/ent-security.nsf/docid/2004052416452048

There's some recommendations for managing Exchange servers, too.

http://service1.symantec.com/SUPPORT/ent-security.nsf/docid/2002090915484448

Hanlon's Razor: Never attribute to malice that which is adequately explained by stupidity.