The Symantec Mail Security for Microsoft Exchange (SMSMSE) Service shuts down five (5) minutes after starting with Error Event ID 185 when Microsoft Exchange Information Store is not reading the VSAPI registry settings

book

Article ID: 156611

calendar_today

Updated On:

Products

Mail Security for Microsoft Exchange

Issue/Introduction

The SMSMSE service stops 5 minutes after starting and writes Event ID 185 and 186 errors to the Windows Application Event log.

Conditions

  • Microsoft Exchange Information Store is not polling VSAPI registry key.

Run Microsoft process monitor and look for the following information:

 

Process Name: store.exe

Operation:  RegSetValue

Path: HKLM\System\CurrentControlSet\services\MSExchangeIS\VirusScan\ReloadNow

Result: SUCCESS

Data: 0

 

 

If these requests are not present then this condition is met.

The following events are written to the Windows Application Event log:

Event Type: Error
Event Source: Symantec Mail Security for Microsoft Exchange
Event Category: Service
Event ID: 185
Description:

The service will be shutdown due to an unexpected failure initializing virus
protection. 
 
Event Type: Error
Event Source: Symantec Mail Security for Microsoft Exchange
Event Category: Service
Event ID: 186
Description:
A timeout occurred while waiting for Microsoft Exchange to initialize the
VSAPI interface. 

Cause

The Microsoft Exchange Information Store is not polling and re-loading the VSAPI settings within the configured timeout value for SMSMSE (defualt is 5 minutes).

When SMSMSE changes the VSAPI settings, SMSMSE changes the value of the registry key HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\MSExchangeIS\VirusScan\ReloadNow from a 0 (zero) to a 1 (one). The Microsoft Exchange Information Store (store.exe) should poll this registry key every minute.  If the value is 1 (one) store.exe reinitializes the VSAPI interface with SMSMSE.  Then store.exe changes the value of the registry key to 0 (zero). 

This error is reported when the value of the registry key is still 1 (one) after five minutes, indicating that the Information Store service is not processing the changes to this key as expected.

 

Resolution

Upgrade to 7.5.2,  Instead of reinitializing VSAPI and waiting, SMSMSE will now completely stop VSAPI, and then restart. This has been found to be effective in all cases of this behavior. 

 Workaround

 In some cases the underlying condition causing store.exe to fail to load the VSAPI interface is temporary. Under these conditions, the timeout value for SMSMSE to stop waiting for store.exe to change the ReloadNow value can be adjusted to avoid this error. This workaround will not be effective if the underlying condition causing store.exe to fail to load the VSAPI interface is not temporary, in these conditions SMSMSE will simply wait longer before writing this error.

To adjust the SMSMSE VSAPI timeout value:

  1. Open the registry editor and navigate to HKLM\Software\Wow6432Node\Symantec\SMSMSE\<version>\Server
  2. Locate the value "VapiInitTimeoutInMS". The default value is 300000 (5 minutes). Change the value to 1200000 (20 minutes). This is likely to be a long enough timeout value to prevent this error.

 

 

 

Attachments

RestartVSAPI.zip get_app