Answer

PROBLEM

GFI MailEssentials Managed Attendant Service (contentsecurity.as.attendant.exe) keeps crashing; mail is backing up or building up in the Global Actions folder.

ENVIRONMENT

• GFI MailEssentials 
• All supported versions of Exchange

SOLUTION

First, if a crash is occurring, we need to get a crash dump. After that, we can determine the cause. The reason for this is that customers usually do not want to take the time to reproduce the issue because this is likely happening on a production server.

The Managed Attendant Service handles the Quarantine Actions Coordinator (QAS), updating of Dashboard statistics, sending the Email Digest, any Notifications, WebDAV scanning, Ticket Management and configuration services.

The main thing that causes MAS crashes is when it is trying to put an action upon an email and is unable to for whatever reason. The actions that the MAS supports are:

• Quarantine
• Forward to Address
• Save to disk
• Move to Exchange folder and subfolder
• Write to CSV (logging)

This is not to be confused with the actions handled by the MTA, which are:

• Delete emails
• Tagging emails with specific text in the header or subject
• Appending the block reason to emails
• Assigning an SCL value so the mail can be routed by Exchange/Outlook Junk E-mail filter

To troubleshoot the MAS, please check the following:

1. Check the QASCoordinator log to see if there are any failures to perform an action. Usually this can be done by searching for the word "error with the double quotes in front of it. If there are any actions that are not succeeding, troubleshoot the issue based on the error.
2. Check the QAS.MTEF (Move To Exchange Folder) log if the QASCoordinator log does not show any errors. Often this will show the reason why the MAS crashes, since this log pertains to things like Autodiscovery and Impersonation in Exchange 2007/2010, which admins do not always set up properly. In Exchange 2000/2003, this will show COM Exceptions if there are any.
3. You can then check the Private Queues within MSMQ to see if emails are building up in the Recovery queue. This is a way to find out if the MAS is failing to perform an action as well.
4. The MESCFG, Dashboard and Remoting Plugin/Helper logs pertain to this service as well, in how it shows items in the Dashboard and how information is pulled and stored in the config.mdb configuration database. If there are any errors in these logs, typically they are of the "cannot save to X item" variety. This can either be because of corruption within the database, permissions issues, or folder/disk space issues.
5. If the logs indicate that port 8021 is being "forcibly closed" (not "actively refused", refused just means the service is stopped), run netstat -abn > portusage.txt to find out what is holding onto those ports.
6. If everything checks out but items are not being flushed from the Private Queues, restart the MAS. It should then attempt to process all the emails stored there again.
7. If the service is still crashing after troubleshooting these items, please contact PSG for assistance.

CAUSE

Various causes the Managed Attendant Service can crash if it is continually trying to route to a subfolder of a mailbox that doesn't exist, to a distribution list, or if it tries forwarding mail to a nonexistent address.