"SMS DOM detected the scan error (Insufficient memory)" appears in SAVLOG.NSF

Products

Mail Security for Domino

Issue/Introduction

The SAVLOG.NSF (Log file for Symantec Mail Security for Domino) shows many "SMSDOM detected the scan error (Insufficient memory)" events.

In SAVLOG.NSF you see events of the type "Warning" similar to:

SMSDOM detected the scan error (Insufficient memory), scan error (Insufficient memory) in database [Global-Mail-Server] Mailbox, document [document ID], author [author name] [author email address], component Message body, Message body. The document is ignored.

NOTE: "Global-Mail-Server", "document ID", "author name" and "author email address" are all variables that will be different for every event.

Cause

Unknown.

Most likely the error is related to environmental conditions.

Resolution

When troubleshooting this error, please consider the following to help you narrow down possible causes cq. resolve the issue:

Make sure exclusions are set correctly.
More information about which folders to exclude can be found in:
'Preventing Symantec Endpoint Protection from scanning the temporary folder of Symantec Mail Security for Domino'
http://www.symantec.com/docs/TECH132218

If the problem happens on a Domino cluster, disable Secure Scanning Optimization
More information about Secure Scanning Optimization can be found in:
'What is Secure Scanning Optimization (SSO)?'
http://www.symantec.com/docs/TECH92261

Make sure you have enough hard drive space to scan.
More information about how to calculate space can be found in:
'Best practices for temporary space usage in Symantec Mail Security for Domino'
http://www.symantec.com/docs/TECH9614

Remove the limit for the maximum memory to use per thread for extracting attachments. (The default limit is “20000 Kilobytes”.)
Here is how to remove the limit for the maximum memory to use per thread for extracting attachments:

Open the sav.nsf settings database with a Lotus Notes Client (a Client with sufficient permissions or an Administrator client).
Open the Server group for which you want to apply the changes.
Click the Threat/Security Risk tab
Click the Basics tab.
In the field “Maximum memory to use per thread for extracting attachments (Files over this size will be extracted on-disk)”, change the value to: 0
On the action bar at the top of the sav.nsf database, click Save.
Stop SMSDOM. At the Domino console, type: tell sav quit
Start SMSDOM again. At the Domino console, type: load nntask

Adjust the number of scan threads in the Notes.ini.
The minimum number of threads is two per processor. The maximum number of threads is four per processor
(The default configuration ensures the best performance for your Lotus Domino server. Normally you should not need to modify the number of processing threads.)
To modify the number of processing threads (see also the Implementation guide):

Stop the Domino server. For details how to to this, please refer to your Lotus Domino documentation.
In the Domino program directory, make a backup copy of the Notes.ini file.
Open Notes.ini in a text editor.
Add the following settings: SAVMailThreads=(value) …… where (value) is the newly computed number of threads.
Save the Notes.ini file.
Close the text editor.
Start the Domino server

If you have the line "SAVExtractOLE10NativeOnly=0" in Notes.ini, try changing it to SAVExtractOLE10NativeOnly=1
When the parameter+value is "SAVExtractOLE10NativeOnly=1", only native data streams are extracted (Native data streams combine sets of objects within a container into a single item rather than treating each object as a separate file.)
When the parameter+value is "SAVExtractOLE10NativeOnly=0", each object is treated separately.

Applies To

Microsoft Windows Server 2003, Enterprise x64 Edition Service Pack 2 (build 3790)
Physical memory: Total: 5.99 GB
Page file memory: Allocated: 20.60 GB (Free: 18.70 GB)
Processors: 8 logical processors (2 cores with hyper threading in 2 physical packages)
Intel(R) Xeon(R) CPU E5320 @ 1.86GHz