Symantec Mail Security for Exchange (SMSMSE) continuously reports Windows application event ID 25 "Updated Virus Definitions" and is not using current virus definitions when multiple copy processes occur at the same time

Article:TECH159953  |  Created: 2011-05-12  |  Updated: 2013-10-25  |  Article URL http://www.symantec.com/docs/TECH159953
NOTE: If you are experiencing this particular known issue, we recommend that you Subscribe to receive email notification each time this article is updated. Subscribers will be the first to learn about any releases, status changes, workarounds or decisions made.
Article Type
Technical Solution


Issue



The SMSMSE Administration Console shows a virus definitions date that is older than one or two days. However the Windows Application event log shows repeated events showing the virus defintions have been updated.

To view the virus definition date used by SMSMSE perform the following steps:

1. Open the SMSMSE Administration Console.
2. On the Home tab the label Virus Definition Date is the date of the virus defintions used by SMSMSE.

Conditions

  • Windows Application Event Log Shows Event ID 25 every ten (10) to twenty (20) minutes:

Log Name:      Application
Source:        Symantec Mail Security for Microsoft Exchange
Date:          5/12/2011 2:34:24 PM
Event ID:      25
Task Category: LiveUpdate/Rapid Release
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      2K8R2.Exchange2010.internal
Description:
Updated virus definitions.

  

 


Error



 

  •  The Windows Application Event log may show this event:

 Log Name:      Application
Source:        Symantec Mail Security for Microsoft Exchange
Date:          5/12/2011 3:00:54 PM
Event ID:      404
Task Category: LiveUpdate/Rapid Release
Level:         Warning
Keywords:      Classic
User:          N/A
Computer:      2K8R2.Exchange2010.internal
Description:
Virus definitions are 6 days old. To remain protected ensure that Liveupdate is working properly.

 
 


Cause



The SAVFMSETask.exe process and SAVFMSESp.exe process have embedded CSAPI library.  When these processes start up or on a scheduled interval, the CSAPI library checks for new antivirus updates.  If one is found then the CSAPI library copies them from the Hawking to the CSAPI directory.  If two different processes attempt to do this copy at the same time they cause interference and the copy process does not succeed.


Solution



Upgrade to SMSMSE 6.5.7 or later.

SMSMSE no longer copies virus definitions.  See the following article for details: Virus Definition Update Methods Available for Symantec Mail Security for Microsoft Exchange (SMSMSE).


 

 


Supplemental Materials

SourceETrack
Value2329710

SourceETrack
Value2059710

SourceETrack
Value2721346



Article URL http://www.symantec.com/docs/TECH159953


Terms of use for this information are found in Legal Notices