Three Services bounce every 30 minutes, one day a week

[monsterjta]

I have an frustrating issue. I have 3 services on my Windows Server 2003/Exchange 2003 Servers that bounce every 30 minutes, for a 12 hour span, about every 6-7 days.

The services are:

* IIS Admin Service
* SMTP
* Microsoft Exchange Routing Engine

This issue started occuring 2 weeks ago on the same day, on each of these servers, at approximately the same time. This anomoly last for 12 hours, then goes away.

Has anyone seem this before? Any advice is greatly appreciated.

 

[djtech2k]

Event Viewer?

 

[djtech2k]

Sorry, hit submit on accident. Have you checked the event viewer for anything? If need be, you could also turn up the auditing event levels on those services if you need to.

Any recent changes?

 

[itsp1965]

I'll ask a silly question, has someone written a sched task/application to bounce these services. It sounds kind of fishy that it's the same services being bounced all the time for the same amount of time

 

[djtech2k]

Well, all of these services are used by exchange though, so if something were wrong in exchange it may cause this.

 

[monsterjta]

Other than the information about those services bouncing, I get this after they come back up:

(Application Log)
DAVEX has successfully started. Version: 6.5.7638.1

and

(System Log)
A process serving application pool 'ExchangeApplicationPool' exceeded time limits during shut down. The process id was '4356'.


There has been a change on each of these Exchange servers. We installed the Symantec Mail Security package on each of them.

 

[djtech2k]

Well, I do not know that product, but I would start there. Just as a guess, it looks like IIS may be part of the problem, or the part thats failing because of something else.

 

[Cstorms]

Well judging on the track record we have had with Symantec virus/security products I wouldnt put anything past them. As an example, out of the blue our DC started locking up sporadically over 2 days, nothing had changed except some small updates to the symantec engine, after installing the then newest patch everything seemed to disappear and work fine, the thing of it was that nothing got documented to any sort of log including event viewer.

 

[monsterjta]

We called Symantec, and they said they released an update a while ago that causes the issue I'm having. They do not have it fixed yet, but gave us a workaround. Basically, we had to edit an XML file (remove a line) that was included in their faulty update.

We made this mod, and I will update this post if/when it solves the issue.

Thanks!

 

[djtech2k]

Sounds good. I agree 100% about Symantec. I have had a number of issues in updates. Less than a year ago, my DC's suddenly started crashing. IN the update 10.1.100 of their corporate AV, there was a memory leak that would accumulate and crash a DC. A new update fixed it. Its a great product, but I do not think they test their updates well enough. But, IMO its still much better than mcafee.

 

[what3ver]

Monsterjta,
Can you please post if editing the file solved your problem and if so what file to edit and what? I am having the same problem on several servers and have attributed it to SMSME, but the only way I have been able to fix it is to stop the service. Thanks.

 

[monsterjta]

The file I needed to edit was bmiconfig.xml.

The line I removed was under the heading:

<!-- all spamhunter ruletypes -->

The actual line I removed was:

<ruleType>body_regex</ruleType>


Haven't had any issues with the services bouncing as of yet. However, this is a temporary fix until Symantec comes out with the update that remedies the issue.

Hope This Helps,

Good Luck!

 

[what3ver]

That seemed to fix it. Thanks!