The Symantec Mail Security for Microsoft Exchange (SMSMSE) Service shuts down five (5) minutes after starting with Error Event ID 185 when Microsoft Exchange Information Store is not reading the VSAPI registry settings

Article:TECH191029  |  Created: 2012-06-14  |  Updated: 2014-09-26  |  Article URL http://www.symantec.com/docs/TECH191029
Article Type
Technical Solution


Issue



The SMSMSE service stops 5 minutes after starting and writes Event ID 185 and 186 errors to the Windows Application Event log.

Conditions

  • Microsoft Exchange Information Store is not polling VSAPI registry key.

Run Microsoft process monitor and look for the following information:

 

Process Name: store.exe

Operation:  RegSetValue

Path: HKLM\System\CurrentControlSet\services\MSExchangeIS\VirusScan\ReloadNow

Result: SUCCESS

Data: 0

 

 

If these requests are not present then this condition is met.


Error



The following events are written to the Windows Application Event log:

Event Type: Error
Event Source: Symantec Mail Security for Microsoft Exchange
Event Category: Service
Event ID: 185
Description:

The service will be shutdown due to an unexpected failure initializing virus
protection. 
 
Event Type: Error
Event Source: Symantec Mail Security for Microsoft Exchange
Event Category: Service
Event ID: 186
Description:
A timeout occurred while waiting for Microsoft Exchange to initialize the
VSAPI interface. 

Cause



The Microsoft Exchange Information Store is not polling and re-loading the VSAPI settings within the configured timeout value for SMSMSE (defualt is 5 minutes).

When SMSMSE changes the VSAPI settings, SMSMSE changes the value of the registry key HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\MSExchangeIS\VirusScan\ReloadNow from a 0 (zero) to a 1 (one). The Microsoft Exchange Information Store (store.exe) should poll this registry key every minute.  If the value is 1 (one) store.exe reinitializes the VSAPI interface with SMSMSE.  Then store.exe changes the value of the registry key to 0 (zero). 

This error is reported when the value of the registry key is still 1 (one) after five minutes, indicating that the Information Store service is not processing the changes to this key as expected.

 


Solution



Ensure that the Microsoft Exchange Information Store service is running and is active (this is listed as store.exe in the Windows Task Manager).

Please contact Microsoft for assistance troubleshooting the root cause of this issue.

 

 Workaround

 In some cases the underlying condition causing store.exe to fail to load the VSAPI interface is temporary. Under these conditions, the timeout value for SMSMSE to stop waiting for store.exe to change the ReloadNow value can be adjusted to avoid this error. This workaround will not be effective if the underlying condition causing store.exe to fail to load the VSAPI interface is not temporary, in these conditions SMSMSE will simply wait longer before writing this error.

To adjust the SMSMSE VSAPI timeout value:

  1. Open the registry editor and navigate to HKLM\Software\Wow6432Node\Symantec\SMSMSE\<version>\Server
  2. Locate the value "VapiInitTimeoutInMS". The default value is 30000 (5 minutes). Change the value to 120000 (20 minutes). This is likely to be a long enough timeout value to prevent this error.

 


Supplemental Materials

SourceETrack
Value3628371


Article URL http://www.symantec.com/docs/TECH191029


Terms of use for this information are found in Legal Notices