Forefront Server Security TechCenter >
Forefront Server Security Forums
>
Forefront Security for Exchange Server
>
WARNING: Not all the engines selected in the Forefront Administrator for scanning have been enabled for signature updates
WARNING: Not all the engines selected in the Forefront Administrator for scanning have been enabled for signature updates
- Hi,
Looking for some help. I am getting the message...
"Mon Jul 07 14:28:52 2008 ( 7388- 7752), "WARNING: Not all the engines selected in the Forefront Administrator for scanning have been enabled for signature updates"
this is written in the ProgramLog.txt and is also being reported by my OpsMgr server every hour. The problem is that the selected engines for scanning and updating are matching.
Anyone any ideas?
Running W2k3 SP2 x64 clustered server, Forefront 10.1.0746.0 & Exchange 2007
Thanks
Pete- Edited bypetesbeat Monday, July 07, 2008 2:23 PMMissed Exchange version
Answers
- Problem solved. The problem was essentially that I didn't have all the engines enabled for schedule in Scanner Updates. Even though the engines I had selected for update matched with the engines I had selected in my scan job, I had to enable all the engines for update - strange idea. I have now enabled ALL scanner engines for update and left the 3 that I am not using on a once only schedule.
I can't understand why you would have the functionality to disable certain scan engines for update if you are then presented with errors when doing so.
Anyway, Problem now resolved.- Marked As Answer bypetesbeat Monday, July 14, 2008 12:09 PM
All Replies
- Are you able to update the engines you are using manually? And did you also check each scan job (SMTP, Realtime, Manual, MTA) to see that the engines being utilized are the engines enabled for updates?
- Yes I can update the engines manually with success. I have checked the scan jobs (we have only Realtime and Manual) and the engine selections match the engiens that are selected for update.
I have tried de-selecting all the engines and then re-selecting them, same problem. I also tried de-selecting 1 or 2 engines (in both update and scan jobs) but alas the same message.
More ideas??
Thanks
Pete - Since you are able to manually update the engines successfully, is it a problem with the schedule updates not working? Or are the engines updating (scheduled or manual), but you're just getting these warnings? I personally haven't seen this warning. And I asked my colleagues and they haven't seen it. Since it's more a warning than an error, unless the engines aren't updating or scanning, then I wouldn't worry about it. You can test each engine by sent the Eicar test virus through and seeing if Forefront catches it. Just enable one engine at a time, and send the Eicar through.
I'm assuming you are on SP1? - The engines are updating OK but we are receiving warnings. Normally I guess this wouldn't be a problem and I could just ignore them, but we have an Operations Manager 2007 server monitoring this and it reports the message once an hour. I could simply override the monitor but then I wouldn't get the notification in a situation where the message is true.
Yes we use SP1. I am happy that Forefront is catching viruses.
I will try to enable all engines for update and scan (we currently don't use 3 engines) and then see what I get. - Problem solved. The problem was essentially that I didn't have all the engines enabled for schedule in Scanner Updates. Even though the engines I had selected for update matched with the engines I had selected in my scan job, I had to enable all the engines for update - strange idea. I have now enabled ALL scanner engines for update and left the 3 that I am not using on a once only schedule.
I can't understand why you would have the functionality to disable certain scan engines for update if you are then presented with errors when doing so.
Anyway, Problem now resolved.- Marked As Answer bypetesbeat Monday, July 14, 2008 12:09 PM
- Your solution got rid of my warning, but introduced another one:
Event Type: Warning
Event Source: Microsoft Forefront Security
Event Category: Health Status
Event ID: 7006
Date: 10/12/2009
Time: 12:37:33 PM
User: N/A
Computer: SRPSHP09
Description:
At least one of the engines enabled for updates has not been updated in the last week.
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
I'm going to just let the warning go. One way or another i'm going to have an hourly warning being logged to the event viewer.
