Sign in
 
HomeProductsLibraryLearnDownloadsSupportForums
Microsoft Forefront TechCenter >
> 
> 
Norman update slowed Exchange 2003

Answered Norman update slowed Exchange 2003

  • Wednesday, January 16, 2013 12:17 AM
     
     
    Sign In to Vote
    0

    This morning, my Exchange 2003 server was running at a snail's pace.  Our mailbox-level backup was still running, so I stopped it, and that didn't help.  Antigen seemed to be using most of the CPU, so I checked programlog.txt and found that it was timing out on almost every message it was trying to scan (realtime and internet).  This started at 6:00am right after a Norman engine update.

    I rebooted the server, and that didn't help.  I then reconfigured my scan jobs to not use Norman, and disabled Norman updates, and after that everything worked itself out (it took a little while to catch up on all the queued messages, but it's been fine since then).  Did anyone else have trouble with Norman update version 1301150001 today?  Should I re-enable updates tomorrow, let it update, then re-enable the engine in my scan jobs and see what happens?  Please advise.

    FYI, I'm running Antigen 9, SP2 (build 9.02.1097).  Below are some snippets from the log.

    Thanks!!!

    Kristen Murray

    Tue Jan 15 06:03:52 2013 ( 3560- 4252), "INFORMATION: The Norman scan engine has been updated from http://antigendl.microsoft.com/antigen/x86/Norman."

    Tue Jan 15 06:05:42 2013 ( 3560- 4184), "ERROR: The Norman scan engine update timed out while sending notification"

    Tue Jan 15 06:05:51 2013 ( 3068- 1636), "ERROR: Realtime scan exceeded the allowed scan time limit"

    Tue Jan 15 06:05:51 2013 (  288-  888), "INFORMATION: RegisterMonitor(0) sets PickupFolderPath for email notification to D:\Program Files\Exchsrvr\Mailroot\vsi 1\PickUp\ for non-cluster"

    Tue Jan 15 06:05:52 2013 (  860- 5556), "INFORMATION: Realtime Scanner Index 0"

    Tue Jan 15 06:08:36 2013 ( 3068- 6104), "ERROR: Realtime scan exceeded the allowed scan time limit"

    Tue Jan 15 06:08:36 2013 (  288-  888), "INFORMATION: RegisterMonitor(0) sets PickupFolderPath for email notification to D:\Program Files\Exchsrvr\Mailroot\vsi 1\PickUp\ for non-cluster"

    Tue Jan 15 06:08:37 2013 ( 5408-  992), "INFORMATION: Realtime Scanner Index 0"

    Tue Jan 15 07:11:34 2013 ( 1344- 5188), "ERROR: Internet scan exceeded the allotted scan time limit while processing message ( =?ISO-2022-JP?B?GyRCJSshPCVJJE4kNDlYRn4kNSRsJF4kNyQ/ISkhKSRiJE8kZD5vPDEhKRsoQkJ)."

    Tue Jan 15 07:11:34 2013 ( 1344- 5188), "INFORMATION: ArchiveMailMsg called to archive d:\Program Files\Sybari Software\Antigen for Exchange\Archive\in\20130115071134004.eml"

    Tue Jan 15 07:11:38 2013 (  288-  888), "INFORMATION: AntigenInternet is shutting down"

    Tue Jan 15 07:11:38 2013 (  288-  888), "INFORMATION: Antigen SMTP scanning subsystem has been taken offline"

    Tue Jan 15 07:11:43 2013 ( 1344- 3536), "ERROR: Internet scan exceeded the allowed scan time limit"

    Tue Jan 15 07:11:44 2013 (  288-  888), "INFORMATION: Antigen Monitor detected SMTPSVC started"

    Tue Jan 15 07:11:44 2013 (  288-  888), "INFORMATION: Antigen SMTP scanning subsystem online"

    Tue Jan 15 07:11:44 2013 (  288-  888), "INFORMATION: RegisterMonitor(1) sets PickupFolderPath for email notification to D:\Program Files\Exchsrvr\Mailroot\vsi 1\PickUp\ for non-cluster"

    Tue Jan 15 07:11:47 2013 ( 4212- 5892), "INFORMATION: Internet Scanner Index 0"

    Tue Jan 15 07:11:48 2013 ( 4212- 2276), "INFORMATION: The "Maximum RBL Lookups" is set to 4"

    Tue Jan 15 07:11:48 2013 ( 1344- 5188), "ERROR: A scanning thread has been terminated and restarted."

     

All Replies