Symptoms

– You are running Lotus domino as your mail server, with Mcaffee’s Groupshield 5.3 for Lotus domino service pack 1 and SpamKiller 2.1 for Lotus Domino service pack 2 installed.

– The auto-update process for SpamKiller fails with the following log:

04/27/2007 09:00:06 AM Start of AutoUpdate
04/27/2007 09:00:06 AM Using anonymous FTP
04/27/2007 09:00:06 AM Commencing the anti-spam rule set download
04/27/2007 09:03:01 AM Obtained anti-spam rule set version 2748
04/27/2007 09:03:01 AM Unzipping the files
04/27/2007 09:03:05 AM Instructing On-Access to pause
04/27/2007 09:03:05 AM Instructing On-Demand to pause
04/27/2007 09:03:45 AM Unregistering the SpamAssassin engine
04/27/2007 09:03:56 AM Copying files to engine directory
04/27/2007 09:04:10 AM The copy of the files failed
04/27/2007 09:04:10 AM Trying to reset back to original version
04/27/2007 09:04:10 AM Copying files to engine directory
04/27/2007 09:04:10 AM The copy of the files failed
04/27/2007 09:04:10 AM End of AutoUpdate

– Although users an still access their mailbox and send e-mails, e-mails are stop being to users after the auto-update failure.

– The Domino server crashes after a few hours with a NSD dump.

– The domino server can not be restarted, and it crashes right after being launched with an NSD dump.

First aid !

The domino server being unstartable now, what you need to do is to fix the problem to restore mail services.

You need to stop the domino server (which is easy if it has already crashed…), then:
– run a repair installation of SpamKiller (run the original installation program while choosing the “repair” option)
– Re-install service pack2
– Re-start the server.
– Once the domino server is running again, launch a manual spam rules definition update.

In case this does not work, you will need to first un-install SpamKiller, then re-install it, re-install SP2 and, once the domino server is running again, launch a manual spam rules definition update.

Refer to McAfee troubleshooting documents KB43493.

Get to Mcafee

If you sucessfuly performed the above steps, you put your server back on tracks for a moment, until the next auto-update fails, which might be tomorrow.

You need now to get in contact with the Mcafee support, explain them your problem, have it analyzed by them and obtain a special fix for your particular problem. You will need a special fix that will be delivered by the technical support of Mcafee.

What you need to do is:

– Download Mcafee MERTool for GroupShield / SpamKiller for Domino, a software used by Mcafee to analyze your configuration. Copy it to your domino server.

Get it here.

– Wait for the next Auto-update failure. It should not be long…

– When the next failure occurs, right after the failure, before the crash and before fixing the problem as recommended in “First aid”, run the MERTool on your domino server.

The MERTool program should create a result file. In case it fails before completion (as it did for me), just consider that the result file is not only “result.tgz”, as is the case when successfully completing, but “result.tgz” + a compression of the “ET~TEMP” folder created next (use WinRar to compress, as the folder is big).

MERToll needs to be run after the problem in order to include a description of your system that can be used for analyze and troubleshooting.

– Apply the “First aid” solution.

– Call Mcafee support. Explain them your case, and when they speak about MERTool”, tell them you did it already.

Transfer the result file to them by the way they wish (ftp) (either “result.tgz” only, or “result.tgz “+ “ET~Temp” compressed)

– Get a case number.

– Specify that you would like your system to be analyzed for the application of hotfixes 242111 and 268121. Those are the ones they recommended for me, so they might be the same for you.

– Call them frequently (every day ?) to know the progress of your case. They tend to forget…

– Stop the automatic updates of the Anti-spam definition rules until Mcafee proposes a hotfix. I would recommend to do a manual update every day instead. You don’t want to spend your time applying the “First aid” solution, it stresses users…

– Apply the patch they recommend when they get back to you.

Advertisements