SMSMSE processes do not start up. SMSMSE does not scan email. In addition symptoms described in this article may appear as well: The Exchange server is beeping, and / or you are getting the following SMSMSE events: 110, 168, 68, and 167, in Windows Application Event log.
A restart of the service Symantec Mail Security for Microsoft Exchange clears the issue.
The following events show up in the Windows Application Event log:
Event ID 110 - The process SavFmsesp.exe failed to start (0xC009008A).
Event ID 168 - The process SAVFMSESp.exe was restarted.
Event ID 68 - Unable to initialize scan engine. The virus definitions may be missing or corrupt. Perform a liveupdate to retrieve the latest virus definitions.
Event ID 167 - The process SAVFMSESp.exe terminated unexpectedly.
When new virus definitions are available SMSMSE copies them from the Hawking directory to the CSAPI directory. If this copy process takes longer than 60 seconds then another SMSMSE process starts the copy process. When there is more than one copy process running at the same time the virus definitions become "corrupted" in the CSAPI directory. This results in the SMSMSE processes not being able to restart or reinitialize themselves.
Upgrade to one of the following versions:
6.0.12 or higher
6.5.5 or higher
These versions increase the time allowed for the copy process to five (5) minutes. NOTE: After the upgrade the symptoms of this issue may be those described in this article:
Symantec Mail Security for Exchange (SMSMSE) Continuously Reports Windows Application Event ID 25 "Updated Virus Definitions" and is not Using Current Virus Definitions When Multiple Copy Processes Occur at the Same Time.
If this issue persists increase the copy timeout using the following steps:
1. Run regedit.
2. Create the following DWORD registry key:
64 bit Operating System: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Symantec\SMSMSE\<version>\Server\DefsUpdateTimeInSecs
32 bit Operating System: HKEY_LOCAL_MACHINE\SOFTWARE\Symantec\SMSMSE\<version>\Server\DefsUpdateTimeInSecs
NOTE: Replace <version> with the version of SMSMSE installed. For example on a 32-bit system with 6.5 installed the key is: HKEY_LOCAL_MACHINE\SOFTWARE\Symantec\SMSMSE\6.5\Server\DefsUpdateTimeInSecs.
3. Set the value of the key to be the timeout in seconds. For example to set a ten (10) minute timeout set the value to 600.
4. Close Regedit.
5. Restart the following SMSMSE service:
Symantec Mail Security for Microsoft Exchange
Configure LiveUpdate to update virus definitions at a time that the server has free resources. Typically scheduling during early morning periods will resolve this issue.
Use the following steps to configure the virus definition update time:
1. Open the SMSMSE Administration Console.
2. Click on the Admin tab. Then click on Views|LiveUpdate/Rapid Release Schedule.
3. Click the Run at a specific time radio option. Then set up the schedule.
4. When finished click the Deploy Changes button.
See the following article for details on virus defintion directories: Virus Definition Update Methods Available for Symantec Mail Security for Microsoft Exchange (SMSMSE).
There are various situations in which this may occur:
Slow hard drive.
Low power CPU.
Many processes running.
Low physical memory resulting in high page swapping.