The Symantec Mail Security for Microsoft Exchange (SMSMSE) Service shuts down five (5) minutes after starting with Error Event ID 185 when Microsoft Exchange Information Store is not reading the VSAPI registry settings
|Article:TECH191029|||||Created: 2012-06-14|||||Updated: 2014-11-19|||||Article URL http://www.symantec.com/docs/TECH191029|
The SMSMSE service stops 5 minutes after starting and writes Event ID 185 and 186 errors to the Windows Application Event log.
- Microsoft Exchange Information Store is not polling VSAPI registry key.
Run Microsoft process monitor and look for the following information:
Process Name: store.exe
If these requests are not present then this condition is met.
The following events are written to the Windows Application Event log:
Event Type: Error
Event Source: Symantec Mail Security for Microsoft Exchange
Event Category: Service
Event ID: 185
The Microsoft Exchange Information Store is not polling and re-loading the VSAPI settings within the configured timeout value for SMSMSE (defualt is 5 minutes).
When SMSMSE changes the VSAPI settings, SMSMSE changes the value of the registry key HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\MSExchangeIS\VirusScan\ReloadNow from a 0 (zero) to a 1 (one). The Microsoft Exchange Information Store (store.exe) should poll this registry key every minute. If the value is 1 (one) store.exe reinitializes the VSAPI interface with SMSMSE. Then store.exe changes the value of the registry key to 0 (zero).
This error is reported when the value of the registry key is still 1 (one) after five minutes, indicating that the Information Store service is not processing the changes to this key as expected.
Ensure that the Microsoft Exchange Information Store service is running and is active (this is listed as store.exe in the Windows Task Manager).
Please contact Microsoft for assistance troubleshooting the root cause of this issue.
In some cases the underlying condition causing store.exe to fail to load the VSAPI interface is temporary. Under these conditions, the timeout value for SMSMSE to stop waiting for store.exe to change the ReloadNow value can be adjusted to avoid this error. This workaround will not be effective if the underlying condition causing store.exe to fail to load the VSAPI interface is not temporary, in these conditions SMSMSE will simply wait longer before writing this error.
To adjust the SMSMSE VSAPI timeout value:
- Open the registry editor and navigate to HKLM\Software\Wow6432Node\Symantec\SMSMSE\<version>\Server
- Locate the value "VapiInitTimeoutInMS". The default value is 30000 (5 minutes). Change the value to 120000 (20 minutes). This is likely to be a long enough timeout value to prevent this error.
Article URL http://www.symantec.com/docs/TECH191029