The GFI MailEssentials AS Scan Engine service is restarting

Overview

The GFI MailEssentials AS Scan Engine Windows service automatically restarts. As a result, Spam emails are not captured by the filters and are being delivered to the users, and email processing has become very slow.

Solution

With tracing enabled, the \GFI\MailEssentials\Antispam\DebugLogs\audldownload.txt log file reports that HTTP fails to connect:

2020-09-17,09:05:23,096,1,"#00000dcc","#00000ddc","warning","audldownload","Trying to connect using HTTPS...FAILED"
2020-09-17,09:05:23,096,1,"#00000dcc","#00000ddc","warning","audldownload","HTTP not allowed"
2020-09-17,09:05:23,096,1,"#00000dcc","#00000ddc","error  ","audldownload","Failed conecting to HTTP"

The Event log shows the faulting application is gfiscans.exe, with the faulting module being purbl.dll:

The GFI MailEssentials AS Scan Engine service terminated unexpectedly. It has done this 166 time(s). 
The following corrective action will be taken in 180000 milliseconds: Restart the service.

Faulting application gfiscans.exe, version 21.6.11004.33, time stamp 0x5e39198c, faulting module purbl.dll, version 21.6.11610.33, time stamp 0x5f315c72, exception code 0xc000000d, fault offset 0x0004861d, process id 0x1e58, application start time 0x01d68cb9eaea0b2e.

This has been linked to a corrupt anti-phishing database. Please follow the steps as described in the "Antispam Scan Engine is crashing constantly" article to correct the corruption. 

Additionally, if the \GFI\MailEssentials\AntiSpam\DebugLogs\ase_greylisting.gfi_log.txt logfile displays the errors below it indicates further corruption in the Greylist filter definition:

2020-09-17,09:00:54,803,1,"#00001320","#000003d4","error ","ase_greylisting","Cannot open Connection, hr = [0x80040606]"
2020-09-17,09:00:54,803,1,"#00001320","#000003d4","error ","ase_greylisting","Module failed to initialize successfully."

To fix this corruption please follow the steps below:

1. Delete the contents from the GFI\MailEssentials\Antispam\Data\Greylisting logs folder.
   Stop the GFI MailEssentials services if you receive a warning when deleting the items.
2. If that does not resolve the issue:
   • Stop the GFI MailEssentials Anti-Spam (AS) Scanning Engine service.
   • Move the greylisting.db file out of the \GFI\MailEssentials\Antispam\Data\ folder to another location.
   • Restart the GFI MailEssentials AS Scanning Engine service.

Testing

After applying the above steps, the service should work normally and spam should be blocked.

If the issue still persists, please generate the troubleshooting logs as follows:

• Make sure that you have tracing enabled.
• Wait for at least 30 minutes to gather enough information and for the issue to be reproduced.
• Run the troubleshooter:
  1. Start > Programs > GFI MailEssentials > Troubleshooter
  2. Follow the Log Generation Wizard for collecting the required and pertinent information.
  3. Select New Case when completing the log generation to attach the logs to a new case that will be automatically created, or open a support ticket manually and attach the logs to that ticket, so that the Support team can investigate the problem.