Forefront on a CCR clustered mailbox server and event id 9411
We are running Forefront for Exchange Server SP1 on all of our Exchange 2007 SP1 servers, including our Hub/CAS and CCR clustered mailbox servers. On the passive CCR node, every 15 minutes or so, we get the following warning events for Template.fdb, ScanJobs.fdb, FileScanners.fdb, Notifications.fdb, and Filterlists.fdb:
---------------
Event Type: Warning
Event Source: FSECCRService
Event Category: CCR Service
Event ID: 9411
Date: 1/3/2008
Time: 10:07:06 AM
User: N/A
Computer: mbx02
Description:
Microsoft Forefront Server Security CCR Replication service has skipped replication of a file.
File: Template.fdb
Reason: Cannot obtain a Forefront Run lock.For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
---------------Any idea what "Forefront Run lock" means, or why these template files are not replicating to the passive node?
Thanks,
Aaron
所有回覆
Do you have the Forefront client UI open on either of your cluster nodes? If so, try closing down the client and see if you still get this message.
Thanks for the response, Andrew. I have had the forefront client UI closed now for at least a couple hours, but I am still seeing event id 9411. I also rebooted the passive node, but that didn't help, either.
Any other ideas?
Aaron
- Did you ever figure this out...I've had this happening since day 1, but never really worried about it
- No, I have not been able to resolve it. The event continues to fill up our Application log.
Your settings may not be getting replicated from the active to passive node if you are seeing this message all the time. Is it possible to move your CMS to the now-passive node? You can try that to see if this event still occurs on the other node. Otherwise, you might want to contact Microsoft support.
- We actually just moved the CMS over to the passive node yesterday afternoon to install update rollup1, and then moved it back. While the CMS was running on the secondary node, the event popped up on the primary node. In other words, the event shows up on the passive node all the time, never the active node.
- Has anyone come up with a solution to this. I am experiencing the exact same symptoms as Aaron.
- I found a description of a problem, but it didin't worked but maybay You I've done something wrong ? :("You receive Warning event 9508 when the FSCcontroller service and other related Forefront services are running on a passive node of a CCR cluster system. In a CCR cluster system, the only Forefront service that runs on the passive nodes is the FSECCRservice. The FSECCRservice is responsible for the replication of data between the active node and a passive node. By default, Forefront Security engines that are running on the passive nodes of a CCR cluster system are updated by an active node. You can change the behavior by using the Redistribution Server option that is available underGeneral Options in the Forefront Server Security Administrator Console.
You can connect directly to the passive node of a CCR cluster only to access the quarantine information. But you must not make any other configuration changes in the Forefront Security for Exchange Server installation on the passive node. When you connect directly to a passive node, you use the Forefront Server Security Administrator on the passive node to access the quarantine information. This starts the FSCcontroller service and other related Forefront services on the passive node. When the FSCcontroller service is started on the passive node, the lock will be set, and the Forefront replication between the nodes will fail. After you close the Forefront Server Security Administrator Console, the Forefront services on the passive node stop, and the replication between the nodes resumes again.
Also, replication of Forefront data between two nodes may fail if you use the Forefront Server Security Management Console (FSSMC) to manage a CCR cluster. When you use the FSSMC to poll a passive node, the FSSMC runs the FSCcontroller service on the passive node. This behavior interrupts the replication of Forefront data between the nodes for a short time. The replication of Forefront data between the nodes starts again after the FSCcontroller service stops."
Mac - Guys any other ideas?? Anybody found solution ??
Mac - Any update here? I am having the same issue. The initial installation turned on Redistribution Server and it's still on. Both nodes are running Exchange 2007 SP2 and FSE SP2.
I see this is also commented on here:
http://social.technet.microsoft.com/Forums/en-US/forefrontexchange/thread/a6e5ba47-462f-40e0-9af4-f76a1e3e3c8b have a look to see if any users have the fssaclient open
I run a little batch file that queries all my servers and close down the consoles if they have been left open.
replace servername with your server name !
tasklist /s servername /FI "imagename eq fssaclient.exe"
once you identify its running
use
taskkill /s servername /F /IM fssaclient.exe
Only ever open the FSSA on your active node on the cluster to prevent these sorts of issues happening. Untick Redistribution Server and re-tick it and click Save to try and force a sync of the engines.
- 已提議為解答SQ Group Tuesday, 29 December, 2009 9:44
- Above proposed is incorrect.
I had the same problem just now. By disabling the local antivirus the problem disappears.
I figured out that the local antivirus scanning the ForeFront data path lockes the files. (in our case that is Sophos)
An exclusions of the data path will solve the problem. Our environment already has all Forefront Paths excluded within the antivirus. We still had this problem periodically. The above solution I proposed worked for our environment. Disabling of local antivirus should not be encouraged as a proposed remedy.
- Agree. Antivirus should not be stopped/disabled on production servers.
For troubleshooting purpose I suggested to temporarily stop and disable the antivirus
and verify the FSECCR replication on the passive node.
at the moment I'm troubleshooting this issue at a cliënt location.
and it seems that the local antivirus scanning is the problem even with exclusions set.
If after the antivirus stopped and disabled you still receive an lock error, you can savely deleted the file that is not replicated on the passive node.
FSECCR should instantly replicate a copy. Also try restarting the FSECCR services.
verify how this goes. until now i've a clean eventlog
i'll keep u posted on my findings.
