Endpoint Protection

Mail marked as "Dead"  with Antivirus/Content Filter Scan Pending.  Manual release.  NTASK doesn't respond to TELL SAV QUIT .  Router locks up and domino has to be forced to shutdown.  Any suggestions?

 I am not sure if this might help

http://www.tek-tips.com/viewthread.cfm?qid=1079577&page=1

On monday one of our customers reported the same problem, SMSDOM 7.5. All new mails are stopped in mail.box with status Symantec Antivirus/Content Filtering Scan Pending. Domino-Server (7.0.3 FP1) will not shut down, has to be forced. I had to replace the (single) mail.box file with a new one (also found the link above). After that, the server worked for about 30 minutes, then the same problem occured again, so this morning domino had to be forced to shut down again. After a restart of the machine it worked.

30 Minutes ago ANOTHER customer called us, same SMSDOM Version, same Domino Version, same problem. It was sufficient to force domino-shutdown and restart the server at this time, but I am pretty sure the problem will come back.

Both dominos only have one mail.box.

 Which version of SEP do you use?

Any news about this issue.

We are also experince 8 of our servers stopping every time a new definition arrives.

Have created a case at symantec support, but they haven't replied yet.

 I am curious to know what parts of SEP you have installed and which you are using (with policy)

Antivirus
Network Protect
Proactive Threat Protection

We are running SAV 10.1.8 and SMSDOM 5.x on those affected servers, so don't think it have anything to do with SEP. So I just think this issue is located in the wrong forum.

http://service1.symantec.com/SUPPORT/ent-gate.nsf/docid/2009082815410454

 ...so all of you are probably using SAV so unless the same problem exist with SEP troubleshooting and FAQ for SEP wont apply.

I just had a call with Symantec-Support, they think they have a solution, the support document above has been updated now: 

http://service1.symantec.com/SUPPORT/ent-gate.nsf/docid/2009082815410454

I have done all that on our customer's machines, until now it seems to work.

This night both servers again had the same defects, in sprite of the patch. Anyone else?

Yes the same here, 9 servers out of 90 are failing, have just escalated the case.

Are your customers only using version 7 of SMSDOM?

We are using 5.0.1.49 at the moment (yeah I know - a oldie):-))

The two servers that are affected here are using Domino 7.03 and SMSDOM 7.5, SAV 10.X.
Servers with Domino 8/SMSDOM 8 and later do not seem to be affected until now.
And I see one 7.03/7.5 Server that is also not affected until now, although it has a very similar configuration (all are Win2003 Server Standard).

Which OS-Versions are your affected machines using? Also W23 Server? (just thinking of some incompatibilities with recent OS-Updates maybe).

Yes we are using 2003 server,  Domino 6.53, 6.54, 6.55 and SAV 10.X

But only 10 % of our systems is affected at the moment.

Have through of a workaround until they fix the problem, could it be possible to stop new definitions to those servers affected, so it wouldn't crash every time a new one arrive.

Do you have any idea?

By the way, haven't head anything from Symantec yet, but will call them soon to get a update.

but they just called me to tell me tell me the case has highest priority now and they are working on it. They also updated the support-document again. I have again done what they write there, but had stops on both servers some hours afterwards. But interestingly while one of the servers is working now for four days after one more restart, the other keeps stopping. Our Customer is very angry meanwhile about all the costs, has already been asking us to change the product....

Does anyone with Domino 8 or higher or SMSDOM 8 have the same problem? I'm thinking of doing a complete upgrade a a last measure to get rid of this ....

While working with support on Sat, found out that SEP engineers put out a new engine on 8/26. Seems to conflict with SMSDOM 7.X

We run about 20 Domino servers running 8.02 w/SMSDOM 7.5.
All our servers rebooted for Sunday maintenance 8/30 at 9am ET.
We started having problems early on 8/31.  I expect the new SEP engine took affect after the reboot 8/30.

I have SMSDOM off on all internal servers & are rebooting the 3 "edge" Domino servers early AM because the 3am LiveUpdates aren't switching to the new virus defs correctly.
I upgraded one Domino server to 8.02FP2. Then I uninstalled SMSDOM 7.5.3.25 & upgraded to 7.5.7.36
Still having problems

I am working directly with Symantec support to figure this out.

But, this has been an issue since 8/30 for us.  Over a week with no resolution.
Another black mark against a "less-than-stellar" support track record.

All attempted fixes have failed to remedy the "Dead Mail" issue with the SMSDOM 7.5.0.19 version.  Back and fourth emails and phone calls with Enterprise Support have resulted in "0" satisfaction.  Symantec stated each case is different and each case has a different remedy.  Nothing more to try as of today.  Affected servers have NTASK disabled.  I'm in a holding pattern and exposed.  Thanks everyone for the posts.....  I will update when more info arrives.....

We are having the exact same problem - and is only on 8 of our 131 servers.
Symantec support is not helping us much, and gives the same answers that everybody else gets.

We are seeing this problem on SMSDOM version 5.1, 7.5.5 and 7.5.7 and on Domino 7.0.3 Fp1.

All 131 servers in our environment is Win2003SP2 and Domino 7.0.3fp1, but it is only 8 which fails.

The 8 servers with problem have 2 things in common that differ from the rest of our servers:
1) They are IBM x346 servers
2) They have all been installed in April 2009 with Win2003 SP2

This is what we have tried so far:
* Followed the Symantec procedure from the tech note - every version since 31/8
* Upgraded SMSDOM from 5.1 to 7,5
* Upgraded SMSDOM from 7.5.5 to 7.5.7
* Uninstalled SMSDOM & SAV.CO.10 and reinstall both
* Run Liveupdate against internal live server
* fixup on sav.nsf
* fixup on 4 mailboxes
* deletion and recreation of 4 mailboxes
* Enabled debug in SMSDOM

NOTHING HELPS....

The last line in the debug file (navtask0.err) is always the following at hang time:
SMSDOM DEBUG [1] Loading scheduled LiveUpdate settings.
SMSDOM DEBUG [1] Creating Scheduled LiveUpdate object for Server Group [DKDDB04 Mail Servers].

Have any of you heard any news regarding this - it seems that they have updated there fix document yesterday, but can't really see what they have changed.

To bad there isn't some more information from Symantec regarding this problem online:-(

Oh well just have to call them again..

We had the same problem on five of our domino servers.
All were running with Win2003R2 SP2, Domino 6.5.6FP3, SMSDOM 7.5.4.29, SAV 10.1.6.6000

This night I removed SMSDOM 7.5.4.29 and installed the newest version of SMSDOM 8.0.1.46 and since then virus definition update is working without having dead mails again.
Log:
09.09.2009 07:44:32   SMSDOM: Updating virus definitions...
09.09.2009 07:44:33   SMSDOM: Switched to virus definitions dated 08.09.2009 rev. 018.

I hope it will stay like this!

If I look in the release notes for SMSDOM 8.x it seems that it is not supporting domino 6.5x, only SMSDOM 7.5 is.

But if there isn't any problems with this version, this could be a solution.

Symantec advised us to install this version and we didn't have any problems.

We have just installed SMSDOM 8.x on a 6.55 server, but I'm a bit uncertain if I should select to update the liveupdater.

Did you do this, I did you leave it unchecked?

I installed the live updater.
All servers are still running fine and we didn't have dead mails again.
It really looks like the new SMSDOM version is the solution.

Yes, our server is also still running, we didn't installed the liveupdate from smsdom8.

We are in the progress of updating the rest of the defective servers to version 8, but are leaving the rest on 5.x for now.

Yes........ :-)

After more than 2 weeks with this error Symantec finally found the bug, and a solution for it:
http://service1.symantec.com/support/ent-gate.nsf/854fa02b4f5013678825731a007d06af/62f928081ce68d3f802576200050a87a?OpenDocument

I have tried the manual work around, but it still does not work.
We have every day or every other day still hang in mail.box with scan pending.

Now we are waiting for Symantec's new release 7.5.8, which are supposed to be posted tomorrow.


Have anybody tried the solution number 3 or 4 ?

Solution 4 has been found to cause other problems. But Solutiosn 1, 2, and 3 are all viable solutions. Though they have fixed the issue with the virus defintion updates that origninaly caused the issue so no futher work arounds should be needed, but we do still recommend getting to the lastest builds of the product for various other defects and issues addressed. 

Hi guys,

today morning I noticed held email by Symantec Mai lSecurity. I would try magic combination tell sav quit but without effect. Nothing happend. In Admin Client SMDOM was missing.

I tried re-install Mail security - without succes, same trouble. I tried delete mail.box files - without succes, same trouble.

Pls, can anyone give some advice?

Thx

L

We having the same problem. Email marked as "Dead"  with Anti virus/Content Filter Scan Pending.  Need to manual release with the hundred email queue .  NNTASK doesn't respond to TELL SAV QUIT. After restart,  it work for a few minutes only and having the same problem again..Our Domino version is 7.5.4.29. For your information, We had do the solution 3 which replace nntask.exe. But it will stuck again and having the same problem.  How can we get a new build for solution 2. Thanks.

I am running Domino 8.5.1 FP3.  Windows 2003 SP2.  SMSDOM 8.0.1.46.  Even tried upgrading to SMSDOM 8.0.6.  SMSDOM will not pull Virus Definitions from Symantec Antivirus 10 definitions on the OS.  Also, on some recently upgraded server we get the Antivirus/Content Filter Scan Pending in the mail.box.  We had this similar issue with SMSDOM 7.5 around the same time 1 yr ago.  Does anyone have a fix for this?  Or can anyone point me in the right direction?  I've uninstalled/reinstalled, updated JRE and JCE Policy files.  No fix yet......