ESET Mail Security for Exchange 4.2 Hanging Exchange & Outlook

I upgraded to ESMX version 4.2.10019.0. Will let you all know if I experience any issues. Thanks

 

The reason Marcos is suggesting deleting files in the TEMP directory (don't delete the actual folder) is because this issue (my original one regarding hanging clients accessing Public Folders with ESET Mail Security) is caused by a hell of a lot of "NODxxxx.tmp" files being generated in the C:\WINDOWS\Temp directory, which ESMX doesn't clean up after itself.

We have about 65,450 of them in there, deleting or moving these out to another location, we were then able to run VSAPI without any performance problems.

However, over the last week I've been on a course, 9,000 have been generated, based on that, in less than 7 weeks it'll reach that number again and hang clients again, unless we keep manually deleting out these tmp files.

I can understand it creating temp files as it scans emails, but it needs to delete them afterwards, the developers need to get this fixed, I've said all this to ESET.

Regarding other posters here, it's definately worth reguarly checking for any and all updates for HP servers (or any manufacturer's servers), back when this first went in Exchange would hang/crash a lot, and it turned out to be out of date firmware on SAS Hard Drives (yes, not only the controller has firmware, the hard drives do too!).

PS. Anyone using ESET Mail Security for Exchange 4.2.* please check your C:\WINDOWS\TEMP folder and tell us how many NODxxxx.tmp files you have, and perhaps the daily average.

 

^^ Thanks for that explanation. We had over 110,000,000 (that's right - millions) in ours. I have created a basic daily script to clear these out now - hopefully that will help our situation until ESET comes out with a better fix.

 

Thanks for the reply. Checked our C:\Windows\Temp but there were only 4 NODxxxx.tmp files in there. However, we only have 5-6 mailboxes currently on our Exchange 2010 server as we can't trust it yet due to the random lockups. We have moved incoming/outgoing e-mail to the Exchange 2010 server.

 

157 here. Although I am having them go on another drive and not the defaullt location. And that dates back to July 15th.

 

Thanks for the info on the SAS firmware. I am going to investigate that as I have applied every other update known to man to our HP server but not sure I caught the SAS firmware.

 

Hi,

I got 2 clients both on sbs 2008, all patched up. - no backupexec.

1 x Dell T410 (i think) - this hangs every 4 days or so with Eset MS
1 x HP (need to check) brand new sbs 2008 - this is fine with Eset MS

Will check temp files later!

Going to try these below, but i'm thinking if we get no fix, I will have to drop my partnership and look elsewhere

http://blogs.technet.com/b/sbs/arch...8-when-using-a-driver-which-utilizes-tdi.aspx

http://blogs.technet.com/b/sbs/arch...on-sbs-2008-with-a-particular-nic-driver.aspx

Cheers Adi

 

Same here. It is hard for me to troubleshoot because I can't just uninstall it and see if the problem goes away, becasue I would have no SPAM protection. I am leaning towards installing Forefront for Exchange though.

 

And another one...

HP ML350 G6
Windows 2008 standard
Exchange 2010 (rollup 4)

Same issues. HPs ASR (Automated Server Recovery) reboots my server almost daily. I just loaded the latest firmware (again, they come out quite often!) for the RAID controller and the server ran for 10 days without restarting. Then twice over the last 24 hours. Sometimes the restart hangs and the ASR restarts the server again before it reboots correctly. Interestingly, it appears to happen mostly outside of normal work hours, usually early in the morning or after 5PM at night. The server is in a data centre so I have only once seen the issue first hand. The system appears to hang although the mouse pointer can still move about. Ctrl-Alt-Del does nothing. I suspect the ASR driver software also hangs as designed and after 10 minutes the BIOS on not seeing any response automatically restarts the server.

Over last two months I have installed latest firmware and driver updates as they are released from HP. Although I have not updated the SAS SCSI hard drive firmware as someone suggested.

I note that although I have Eset Mail Security 4 for Exchange version 4.2.10019.0 installed, I don’t have piles of temp files turning up in the c:\windows\temp folder (I have not redirected my temp files to another location). But, I have turned off “Background scanning” in the VSAPI 2.6 settings options. I don’t like the idea of the AV continuing to scan my 70GB of mail on the server every time a signature update comes out. I wonder if the temp files are created by a programming issue in this function.

As of this morning, I am running my server with real time filesystem protection turned off and only mailserver protection enabled to see if it helps.

 

Forgot to mention we disabled Background Scanning too at Eset's suggestion, these files are generated by VSAPI real-time protection, it appears to generate a tmp file for every email it scans.

Our server is grinding as I write this, though it only had 5,882 NODxxx.tmp files in there, I've moved these to another location (incase they're needed by doubt it) however the server is still "dying", it's very slow, the ESMX GUI will not open setup tree, in fact it now won't even open the GUI at all, I've logged off and back on, same... so I just had to reboot it entirely... fantastic (sarcasm).

 

Thanks god i did a 30 day trial!

I'm tempted to go down the Trend route now ...

 

Disabled the Backgound scanning some time ago as well as it was causing Outlook clients to FREEZE!

So what is the trick here? Disable everything in ESMX config? What is the point then?

 

That did not help! (it ASR’ed again). Now I have turned off all auto updates of the AV and anti-spam signature files. To see if that might help.

AndrewGVS: I am not having those issues? no left over .tmp files or slow response. Maybe with so many file handles open the server is slowing down. Under the “Performance” item in the setup tree, I have a blank temporary folder specified (so I believe it defaults to c:\windows\temp).

Has anyone installed Exchange 2010 SP1? and can report that their problems have stopped? Maybe it's an Exchange VSAPI issue as well?

In addition, I am now trying my server with VSAPI disabled and “Transport Agent” only enabled. So I am assuming that external incoming emails will still be scanned for AV and Anti-spam?

 

We have downloaded SP1 and have been tossing the idea around of installing it.
We figured the worse that could happen is that SP1 wouldn't be compatible with ESMX and cause problems...oh wait, it does that already. It will probably be next week before we install.

 

We are holding off as well. After yesterdays update SNAFU that killed over 1000+ machines that we support and the current inability of ESET to fix NOD32 to properly work on an Exchange server we are seriously considering moving all 150+ of our clients to another product. I personally have had enough of this.

 

Yes, we also have requested a quote from Symantec to possibly replace ESMX. We have a perfectly good Exchange 2010 server sitting here with one mailbox on it (my mailbox), due to the fact we cannot trust the server enough to move our 250+ users to it. Desktop wise, NOD32 has been doing good for us (besides yesterdays issues of course) so we will most likely be staying with that. But it's looking more and more like we will have to dump ESMX as the lockup problem can't be resolved and we have to move soon from our Exchange 2003 server that is well beyond it's life cycle now.

 

Could search your drives for NOD*.tmp and see if it finds anything, if not leave it open and watch it while you send an email, might see one appear and dissapear (which is expected behaviour), ours aren't being removed automatically for some reason.

We're still on Exchange 2003 SP2, though aim to be on Exchange 2010 in the near future, maybe we'll get this issue then.

My advice is to check all your updates, firmware, on all components, particularly hard drives, raid controllers and any updates from Microsoft (2003 had a Storeport update), that corrected locks ups and freezes we had when Exchange 2003 first went in, we thought it was Eset at first, but Eset just made the problem more prominent, it was actually hard drive/controller firmware out of date.

That's what I thought, when I disabled VSAPI and just left transport agent on, it was all we could do until we discovered the NOD files in the temp dir and removed them.

I would definately email support and see what they say.

 

I had several non Exchange servers crippled by the bad ESET signatures last week...

Have searched for *.tmp and can’t find any NOD temp files anywhere.

I have preformed all the firmware updates etc. After the last SAS SCSI firmware update and installing the latest EMSX version from ESET, I thought I might have got some stability…and maybe I have, expect for the SNAFU with their signature updates last week.

Since updating my signatures on our Exchange server to fix the SNAFU, I have disabled the automatic signature updates. I will run with what I hope will be a stable signature release for a week or so to see if the server behaves it’s self. Touch wood, it has been running good since.

 

Yeah, 5417-5419 caused a lot of problems, and at first I thought it was the Exchange ESMX problem rearing it's head again, until I discovered it was a little more widespread.

 

I am glad I came across this topic.

A customer of us has a HP DL360 G5 with SBS 2008. In a couple days we changed a lot, upgraded the RAM, updated to Server 2008 SP2, updated to Exchange 2007 SP2, merged data/mail and installed ESET Mail Security 4.2.10019.0.

After a couple days the server restarted itself, couldn’t find a reason. After the first restart it happened more often, sometimes after 2/3 day’s, sometimes more than twice a day (even during business hours). Like the rest the server just freezed (black screen) and you have to turn it off or wait for HP ASR to restart it. In our event log we had some HP ILO warning messages. Updated all the possible HP drivers & firmwares, still the problem excisted. We contacted HP and they replaced the motherboard, HP ILO warning messages in the event log where gone.

The server run fine for 6 day’s, so thought we got is solved. Unfortunately it crashed again. After reviewing all our actions I decided to check for a new ESET version an look here. And glad I found this topic!

Contacted ESET Netherlands support. It was a known bug in the ESET driver. They send me a beta driver (eamonm.cat, eamonm.inf & eamonm.sys) which you can replace in safe mode. The bug is already fixed in the latest version of ESET Antivirus and Smart Security and will be included in the next version of Mail Security. A other solution is to disable file scanning on creation?

I decided to remove Mail Security 4 and reinstall the old XMON 2.7. With the ESET 5418 update in mind and this issue the trust in ESET products is very low.

 

Nice to know that ESET Netherlands acknowledges the problem. Can you please share the driver they provided you with us?

 

Do you have any idea when the next version of Mail Security is due out?

I have now un-installed Mail Security 4 and installed the Trend Micro ScanMail 30 day demo product to see if I get stability from this server. We have paid for the ESET product so we would still like to see it fixed.

 

I take it, that's the ESMX hard crashing issue, and not the "grinding to a halt, slowing everyone up, with a tonne of NODxxxx.tmp files in C:\Windows\Temp" issue (which can also cause a crash due to ASR, or something rebooting the system as it's practically hung up)?

Currently have 12,922 NODxxxx.tmp files in C:\Windows\Temp, I'm watching it to find how many causes the degredation (the other week the 5418 update caused me to think it had happened early with few NOD files).

 

Attached the driver.
http://www.easy-share.com/1912278520/eamonm_4.2.62.zip

@pcdpaul: They didn't know that.

@AndrewGVS: Maybe the support staff can confirm that. I mailed them this topic.

EDIT:
Got a mail back from ESET Netherlands. The driver only fixes the issue of a freezing machine when it is a Domain Controller. This happens when the machine has a old version of the ESET driver, it is confirmed and tested that this drivers fixes the issue with a freezing DC.

Our customer has a SBS machine (so it does include a DC), so maybe the fix should work for me...

 

Thank you very much for sharing the drivers with us!

Can I just copy the files to C:\Program Files\ESET\ESET Mail Security\Drivers and to C:\Windows \System32\drivers (in safe mode), or do I have to do more special things?