Event IDs 68 and 110 entries appear in the Application Event log after importing a Symantec Mail Security for Microsoft Exchange (SMSMSE) 6.0 settings file into SMSMSE 6.5

Article:TECH131734  |  Created: 2010-01-15  |  Updated: 2014-05-06  |  Article URL http://www.symantec.com/docs/TECH131734
Article Type
Technical Solution


Issue



You imported your Symantec Mail Security for Microsoft Exchange 6.0 settings file into Symantec Mail Security for Microsoft Exchange 6.5 and are now seeing Event IDs 68 and 110 entries in your Application logs.



Steps to Import Settings:

1. Open the Symantec Mail Security for Microsoft Exchange Console

2. Click File > Import...

3. Click Ok

4. Browse to the settings file you would like to import

5. Select the settings file you would like to import and click Open

6. Click Deploy changes

7. Click Deploy Imported

8. After deploy completes click Close


Symptoms
Symptoms will be identical to those described in this document: 'The Exchange server is beeping, and / or you are getting the following SMSMSE events: 110, 168, 68, and 167, in Windows Application Event log.'

  • You may also see a virus definition date in the SMSMSE console of 1/1/1601

Conditions

  • Settings were imported from a pre-6.5 system.
  • Match list contains a regular expression.
    To verify this condition perform the following steps:

      1. Open the SMSMSE console.
      2. Go to Policies > Match Lists.
      3. Select the appropiate match list and click Edit match list....
      4. The type of match list is shown in the Match type field.
      5. Look in the Filter (one per line) field to determine if you have any wildcard entries (e.g. *@domain.com, *.exe). If there are wildcards then this condition is met.

 


Cause



SMSMSE 6.5 no longer allows wildcards in regular expressions match lists. When these expressions are encountered SMSMSE incorrectly reports virus definition corruption.


Solution



Remove the wildcard entry from the matchlist or change the matchlist type to Literal String or Wildcard.

To change the Match list type:


    1. Open the Symantec Mail Security for Microsoft Exchange Console
    2. Go to Policies > Match Lists
    3. Select the appropiate match list and click "Edit match list..."
    4. The type of match list is shown in the "Match type:" field
    5. Change this to Literal String or Wildcard
    6. Click Ok
    7. Click Deploy changes
    8. After deploy completes click Close

To remove wildcard entries from the Match list:


    1. Open the Symantec Mail Security for Microsoft Exchange Console
    2. Go to Policies > Match Lists
    3. Select the appropiate match list and click "Edit match list..."
    4. Look in the "Filter (one per line):" field to determine if you have any wildcard entries (e.g. *@domain.com, *.exe)
    5. Remove any wildcard entries you find
    6. Click Ok
    7. Click Deploy changes
    8. After deploy completes click Close



Supplemental Materials

SourceETrack
Value2028062

Legacy ID



2010041516172454


Article URL http://www.symantec.com/docs/TECH131734


Terms of use for this information are found in Legal Notices