ESET Mail Security for Exchange - "Reading message characteristics failed"

Discussion in 'Other ESET Business Products' started by TJColin, Sep 18, 2012.

Thread Status:
Not open for further replies.
  1. TJColin

    TJColin Registered Member

    Joined:
    May 27, 2011
    Posts:
    7
    Our client is running ESET Mail Security for Microsoft Exchange Server on Windows Server 2003 SP2 (SBS 2003).

    Exchange version 6.5.7638.1 (2003 SP2).

    EMON version 4.3.10025.0

    We noticed poor performance on the server so I went on to investigate. I noticed that both store.exe and ekrn.exe are using a constant ~5%+ CPU each.

    I looked through the information in ESET to see whether it was 'doing' something specific. I can't see anything in particular that tells me, but eventually I came to the "Events" log files.

    Here is an excerpt of today's log:
    18/09/2012 11:10:44 Microsoft Exchange Server protection Reading message characteristics failed. NT AUTHORITY\SYSTEM
    18/09/2012 11:10:44 Microsoft Exchange Server protection Reading message characteristics failed. NT AUTHORITY\SYSTEM
    18/09/2012 11:10:44 Microsoft Exchange Server protection Reading message characteristics failed. NT AUTHORITY\SYSTEM
    18/09/2012 11:04:27 Microsoft Exchange Server protection Reading message characteristics failed. NT AUTHORITY\SYSTEM
    18/09/2012 10:57:11 ESET Kernel File 'Your_Friend_New_photos-updates.jpeg.exe' was sent to ESET for analysis.
    18/09/2012 10:57:11 ESET Kernel Statistical information was sent to ESET.
    18/09/2012 10:46:43 ESET Kernel Virus signature database successfully updated to version 7489 (20120918 ).
    18/09/2012 08:42:38 Mail server protection Antispam engine rules have been updated
    18/09/2012 08:42:36 Mail server protection Downloading antispam engine data files completed successfully.

    After this, there are a good several more pages repeating "Reading message characteristics failed." from 11:10:44 up to 11:24:31 (it is now 12:15). There are up to around 50/second.

    So, my question now is...
    Does anyone know what this message means, or what I can do about it?

    I have tried both Google and searching these forums but cannot find any useful information.

    Meanwhile, I guess that the server had elected to do a "background scan" of the full Exchange Server database. For now, I shall disable the "background scan" option. If it looks like things improve, I'll work out how to schedule a scan of the database as described in the help file.

    Thanks for your help!
     
  2. dwomack

    dwomack Eset Staff Account

    Joined:
    Mar 2, 2011
    Posts:
    588
    PM Sent
     
Thread Status:
Not open for further replies.