Norman updates causing failed mails

Versions / Builds Affected

20101129

Status

Resolved

Problem Summary

After Norman AV definition updates all emails would land up in FailedMails.

TT / JIRAID

MSEC-25, MEC13

How to Identify

After Norman AV definition updates all emails would land up in FailedMails. Logs would show: 2011-07-06,13:27:30,969,3,"#00001370","#00001544","info ","SCore","Scan: Calling [Virus Scanning Engine]..." 2011-07-06,13:27:31,173,1,"#00001370","#00001544","error ","SCore","Scan: Calling [Virus Scanning Engine]...ok[25]" 2011-07-06,13:27:31,173,3,"#00001370","#00001544","info ","SCore","Scan: stopping scanning loop..." 2011-07-06,13:27:31,173,3,"#00001370","#00001544","info ","SCore","Scan: left scan..." 2011-07-06,13:27:31,173,3,"#00001370","#00001544","info ","SCore","MMQ::Submit: success" 2011-07-06,13:27:31,173,1,"#00001370","#00001544","error ","SCore","Scan: final result(CRITICAL)" 2011-07-06,13:27:30,969,3,"#00001370","#00001544","info ","VSE","SyncProcessPluginStatus: plugin [Norman Engine] enabled and licensed, initializing..." 2011-07-06,13:27:31,173,1,"#00001370","#00001544","error ","VSE","SyncProcessPluginStatus: plugin [Norman Engine] failed to initialize" 2011-07-06,13:27:47,891,3,"#00001370","#00001544","info ","Norman","EngineFolder [C:\Program Files (x86)\GFI\ContentSecurity\Antivirus\nvc\nse]" 2011-07-06,13:27:48,110,1,"#00001370","#00001544","error ","Norman","CNormanScanner::InitVSEngine - Error: Norman Initialization failed" 2011-07-06,13:27:48,110,1,"#00001370","#00001544","error ","Norman","Failed to initialize scanning engine: 0x80004005" 2011-07-06,13:27:48,110,3,"#00001370","#00001544","info ","Norman","CNormanScanner::UninitVSEngine- Norman Engine uninitialized" Cause: When MailSecurity performs an Antivirus update, it first downloads the definition files. Once the new files are downloaded the engine is being unloaded from memory. Then the new definition files are copied in place and the AV engine is loaded again. The problem with the Norman engine is, that it needs 100 MB of continues memory (in one junk) to be loaded. If the system is running low in memory or the memory is fragmented, the engine fails to load and all emails land up in the FailedMail directory.

Workaround / Fix Details

An autoupdate went out that should correct the issue. Enable the engine and trigger an update. If this does not resolve the issue, then there is likely a corruption with the current definition set and clearing them out and re-downloading should resolve the issue. -Upgrade customer to GFI MailEssentials 2015 or later

Required Actions

- Upgrade customer to GFI MailEssentials 2015 or later Apply the workaround and attach the article to the case.