Troubleshooting dead mail in a Symantec AntiVirus/Filtering or Symantec Mail Security product for Lotus Domino

Article:TECH80489  |  Created: 2002-01-15  |  Updated: 2014-06-24  |  Article URL http://www.symantec.com/docs/TECH80489
Article Type
Technical Solution


Issue



Dead mail accumulates in the Mail.box when a Symantec for Domino product is enabled.

You have one of the following versions of Symantec AntiVirus/Filtering for Domino or Symantec Mail Security for Domino: 

  • Symantec Mail Security 8.1 for Domino
  • Symantec Mail Security 8.0 for Domino
  • Symantec Mail Security 8.0 for Domino Multi-Platform Edition
  • Symantec Mail Security 7.5 (2007) for Domino
  • Symantec Mail Security 5.1 for Domino
  • Symantec Mail Security 5.0 for Domino
  • Symantec Mail Security 4.1 for Domino
  • Symantec Mail Security 4.0 for Domino
  • Symantec Mail Security 3.2 for Domino Multi-Platform Edition (UNIX and AS/400)
  • Symantec AntiVirus/Filtering 3.0x for Domino (UNIX and AS/400)

Solution



The following topics are currently known configuration problems that can cause dead mail. To troubleshoot, work through each section.


Before you begin: Please update to the most current build of Symantec Mail Security for Domino - Multi-Platform Edition 3.2 (UNIX and AS/400) or Symantec Mail Security for Domino 8.0/8.1/7.5.



Fully qualified Internet host name or network address does not resolve
Symantec products rely on name resolution to be able to scan the mail.box.
One indication of a name resolution problem is that all email is marked DEAD in the mail.box when you enable Symantec AntiVirus/Filtering for Domino or Symantec Mail Security for Domino.
Verify that your fully qualified Internet host name and your net address configuration is correct.

To verify fully qualified Internet host name configuration

    1. Open the Domino Administrator.
    2. On the Configuration tab, expand Servers.
    3. Click All Servers, and then double-click the correct server document.
    4. On the Basics tab, verify the contents of the Fully qualified Internet host name text box.
    This text box contains the name that Domino assumes to resolve to the IP address of the server. Under most circumstances, this should match the name that the operating system reports when you run the "ipconfig /all" command at a command prompt.


To verify the Net Address

    1. Open the Domino Administrator.
    2. On the Configuration tab, click expand Servers.
    3. Click All Servers, and then double-click the correct server document.
    4. In the server document, click the Ports > Notes Network Ports tab.
    5. For each port that uses the TCP protocol, verify that the contents of the Net Address text box resolves to the server's IP address.
    This text box contains the name that other servers and any third-party software installed in the Domino environment uses to resolve to the server. Under most circumstances, it should be the server's host name as reported by "ipconfig /all" or the server's IP address. It is a common mistake for Domino administrators to indicate the IP address of their NAT server or Internet gateway.

If the name in either of these text boxes does not resolve through normal methods and cannot be changed due to policy, you must implement another mechanism for name resolution. Some possible solutions include creating an alias in DNS for the host name as it appears in the server document or creating a link between the IP address and the host name in the operating system's hosts file.

The command "trace <servername>" can be used at the Domino console to quickly determine what hostname and IP address Domino uses to resolve to itself. Replace "<servername>" with the Domino name of the server.

Verify Symantec Mail Security for Domino is Running:
At the domino console type "tell sav info" if it returns an error such as 'The sav command does not exist or does not accept "Tell" commands.' or no results are returned the Symantec Mail Security for Domino process may not be loaded, or has stopped responding.

To load the Symantec Mail Security for Domino task type "load nntask" in the domino console. If this fails to load the process may be unresponsive. If Symantec Mail Security for Domino has become unresponsive it may be neccesary to restart the system.

Corruption in the mail box or mail boxes

Dead mail can occur because of corrupted or misconfigured mail box files.

First, check the number of mail boxes on your Domino server. If you are using a single mail box, it is named mail.box. If you have multiple mail boxes, they are named mailx.box, where "x" is the number of the mail box. For example mail1.box, mail2.box and mail3.box. If you have a mail.box as well as multiple mail boxes (mailx.box), Symantec AntiVirus/Filtering for Domino or Symantec Mail Security for Domino may scan in the wrong file which can result in dead mail. In this case remove the mail.box.

If the number of mail boxes is correct, one or more could be corrupted. One way to test for a corrupt mail box is to rename all mail boxes.


To rename the mail boxes

    1. Stop the Domino server.
    2. Rename all mail boxes.
    3. Restart the Domino server.
    When the server restarts new mail boxes are created.


If the dead mail problem does not return, one of the renamed mail boxes is probably corrupted and you must delete or repair that mail box. The other mail boxes (if any) are probably not damaged in any way.

Decomposer and virus definition issues

Symantec AntiVirus/Filtering for Domino and Symantec Mail Security for Domino products store virus definitions in the following location:
C:\Program Files\Common Files\Symantec Shared\Virusdefs

 


Note: On non-Windows operating systems, the virus definitions are in the following location:
/opt/Symantec/virusdefs



The virusdefs folder contains one or more numbered folders. Each numbered folder contains multiple files. The number of files varies depending on the product, operating system, and version.

If virus definitions do not appear to be corrupted, check the version of Symantec AntiVirus/Filtering for Domino and Symantec Mail Security for Domino that you have installed. If you have an older version, it may not scan a file type it does not recognize, which can result in mail being marked as dead.

Verify your virus definition date.  Is it current?  If not this could indicate an issue with Java Live Update.  To troubleshoot these issues, please follow the link below:

http://www.symantec.com/docs/TECH137053

You can also manually update definitions by running the intelligent updater for this product:

 

http://www.symantec.com/security_response/definitions/download/detail.jsp?gid=sep


slNNTASK.dat

 

When this file is corrupted, Mail security may not start properly and nnem.dll may mark all email as dead.  Please delete this file while ntask is not running, so it can be re-created when ntask starts up again.  The location of this file is in <domino data directory>/smsndb/ and it is a hidden directory.

Email scanning tools

If the local antivirus software is scanning email through email scanning tools or by actively scanning the domino or SMS directories, this "tug-o-war" between the products can cause time-outs, conflicts, and other conditions that could lead to this issue.  Please verify that all directories that have to do with email are excluded from scanning from the local operating system antivirus and that the antivirus tools are uninstalled.  This will allow Mail Security for Domino to perform without interferrence from other software.

Other
If you still see dead mail, you can enable navdebug or savtrace (depending on the version of the software you are using). For steps to enable debugging go to the Symantec document: http://www.symantec.com/business/support/index?page=content&id=TECH80022&locale=en_US
 

 

Multiple Domino servers deployments - check for replica problems
If SMSDOM is installed across multiple Domino servers and databases are replicated, please ensure the correct replica structure is in place.
For more information on how to properly setup replicas across your environment, please refer to the article "TECH97823" in the "Related Articles" section.

 




Legacy ID



2002101513411954


Article URL http://www.symantec.com/docs/TECH80489


Terms of use for this information are found in Legal Notices