Reply
Stone Emissary
allenjamieson
Posts: 8
Registered: ‎01-26-2010
Accepted Solution

scanmail 10 virus pattern files not updating

we have scanmail 10 (exchange)which isnt updating the pattern files for viruses

 

the error we get is active update process was terminated because an error occurred while building the incrimental file

 

any ideas?

 

we manually try updating but that dosent work

Please use plain text.
Stone Emissary
allenjamieson
Posts: 8
Registered: ‎01-26-2010

Re: scanmail 10 virus pattern files not updating

heres the log

 

Please use plain text.
Affiliate
Henrik
Posts: 66
Registered: ‎02-03-2010

Re: scanmail 10 virus pattern files not updating

The log show that the process updating/building the new pattern file is out of memory.

 

 

Inf 20100508 14:30:44 1728 2872 Total number of diffs need to be built: 6
Inf 20100508 14:30:44 1728 2872 Build a diff file: old file[C:\Program Files\Trend Micro\Smex\AU_Data\
                                AU_Storage\3\4\711700\lpt$vpn.117] new file[C:\Program Files\Trend Micro\
                                Smex\AU_Data\AU_Temp\1728_2872\DupMerge\3\4\lpt$vpn.153] diff file[C:\
                                Program Files\Trend Micro\Smex\AU_Data\AU_Temp\1728_2872\AU_Down\pattern\
                                v_f00.153]
Inf 20100508 14:30:44 1728 2872 RTPatchBuildWriteHeader: ret: 0
Inf 20100508 14:30:52 1728 2872 RTPatchBuildCompareFiles: ret: 19
Inf 20100508 14:30:52 1728 2872 RTP WARNING: 
                                warning wbd0060:   (MapViewOfFile failed. GetLastError = 8)
                                
                                
Err 20100508 14:30:52 1728 2872 ERR: 
                                error ebd0019: Not enough free memory to run.
                                
                                
Err 20100508 14:30:52 1728 2872 Build diff failed, all previous build diffs released and error quit.
Inf 20100508 14:30:52 1728 2872 Cleanning Temp dir [C:\Program Files\Trend Micro\Smex\AU_Data\AU_Temp\
                                1728_2872]
Inf 20100508 14:30:52 1728 2872 UpdateManager endwith 66 (420007): ActiveUpdate process was terminated 
                                because an error occurred while building the incremental file.
Inf 20100508 14:30:52 1728 2872 End TmuDuplicateEx()

 

 


I am a Trend Micro Affiliate. My comments and advice come from my personal knowledge and experience. I’m happy to volunteer what I can to help others have a great Trend Micro experience.
Please use plain text.
Stone Esquire
Locke
Posts: 1
Registered: ‎06-23-2010

Re: scanmail 10 virus pattern files not updating

Hello,

we have the same problem and the same error message.

Our System has 13 GB Diskspace and 1,5 GB Memory free, what kind of memory is not enough?

The only solution that now works is to separate failed updates and run it one by one. That works

Downloading virus pattern seems that downloads very tinme full version, not incremental.  

 

Please use plain text.
Stone Emissary
allenjamieson
Posts: 8
Registered: ‎01-26-2010

Re: scanmail 10 virus pattern files not updating

i found i needed to manually delete and install the new pattern file

 

C:\Program Files\Trend Micro\Smex\engine\vsapi

 

in primary, secondary etc in pattern files delete all pattern files that start with lpt$vpn

 

you will need to download the latest one from http://downloadcenter.trendmicro.com/index.php?clk=left_nav&clkval=pattern_file&regs=uk

 

and paste them into all the primary / secondary etc pattern files folders

 

you then also need to restart the scanmail exchange master service and the remote config server service and this will update it

 

it should then update ok

Please use plain text.
Stone Esquire
htluser
Posts: 3
Registered: ‎08-09-2010

Re: scanmail 10 virus pattern files not updating

We're getting this problem at a site as well.

It will automatically update most of the items, but the Virus Pattern and AntiSpam pattern often fail.

I've found that selecting them one at a time and running the manual update sometimes works, but not always.

 

It's rather annmoying to have to manually download the files, copy them, restart the service, and also restart the cluster service as well.

 

Dave

 

Please use plain text.
Stone Emissary
alivingstone
Posts: 7
Registered: ‎12-21-2009

Re: scanmail 10 virus pattern files not updating

We are also getting this error.

 

I have to manually download the pattern file every day or two and apply it by following the instructions above (delete existing lpt$xxx pattern files, copy in new file and restart services).

 

This then shows the latest pattern file loaded however subsequent manual or scheduled updates via the ScanMail GUI fail with

 

"An ActiveUpdate process was terminiated because an error occurred while building the incremental file."

 

Any logs I can look at to see why it is failing?

 

Windows 2003 2 node Active/Passive Cluster with Exchange 2003.

 

Cheers,


Anthony.

Please use plain text.
Stone Emissary
alivingstone
Posts: 7
Registered: ‎12-21-2009

Re: scanmail 10 virus pattern files not updating

[ Edited ]

Sorry - found TmuDump.txt

 

Error claims : Error ebd0019: Not enough free memory to run.

 

Server has 12GB of Ram.

Perfmon shows 9GB available.

 

Anybody have any suggestions / fixes????

 

(Not practicle to reboot the nodes until the monthly maintenance window due to the production environment.)

 

Log snippet:

 

Inf 20100813 11:57:17 11972 9812 RTPatchBuildWriteHeader: ret: 0

Inf 20100813 11:57:31 11972 9812 RTPatchBuildCompareFiles: ret: 19

Inf 20100813 11:57:31 11972 9812 RTP WARNING: warning wbd0060: (MapViewOfFile failed. GetLastError = 8)

Err 20100813 11:57:31 11972 9812 ERR: error ebd0019: Not enough free memory to run.

Err 20100813 11:57:31 11972 9812 Build diff failed, all previous build diffs released and error quit.

Inf 20100813 11:57:31 11972 9812 Cleanning Temp dir [C:\Program Files\Trend Micro\Smex\AU_Data\AU_Temp\ 11972_9812]

Inf 20100813 11:57:32 11972 9812 UpdateManager endwith 66 (420007): ActiveUpdate process was terminated because an error occurred while building the incremental file.

Please use plain text.
Trend Micro Employee
rjmel2000
Posts: 1
Registered: ‎09-30-2009

Re: scanmail 10 virus pattern files not updating

Try to disable smart duplication on the SMEX server. SMEX will download the (small) diff files instead of all of them.

 

Path:   HKEY_LOCAL_MACHINE\SOFTWARE\TrendMicro\ScanMail for Exchange\CurrentVersion
   Value: EnableSmartDuplicate
   Type:  DWORD
   Data:  0
  

If this failed, let me know the build number of SMEX by going to help>about just beside the logoff button.

 

If this solution works, let me know also.

 

Thanks!


I am a Trend Micro employee.  My comments and advice come from my personal knowledge and experience.  I’m happy to volunteer what I can to help others have a great Trend Micro experience.
Please use plain text.
Stone Emissary
alivingstone
Posts: 7
Registered: ‎12-21-2009

Re: scanmail 10 virus pattern files not updating

Thanks for that rjmel2000.

 

Buils = 10.0.0.1412

 

As luck would have it the automatic updates (scheduled for 02:00 each night) had worked fine over the weekend.

My last manual update using the zip file on Friday may have resolved the issue even though previous attempts seemed to have made little difference.

 

Looking at the log files it appears the customer had attempted 4 manual updates via the GUI around 09:00 this morning and these had all failed with Proxy Authentication errors although nothing had changed on the proxy settings.

 

I suspect issues may have initially been caused by a slow 2MB internet pipe being used by 650 users and 50 servers!  Manual updates during the day tended to fail regularly with Proxy Authentication errors - but would work the odd time.

 

With ovrrnight automatic updates being able to connect out but failing with an Out of Memory error applying the update.

 

I implemented your reg hack as suggested and performed a manual update (seemed to look for about 95MB of updates!) and this also worked fine today.

 

Hopefully this reg hack to download differential updates will help - they should also be getting a new 100MB link next week.

 

Thanks for taking the time to look at this.

 

Anthony.

 

 

Please use plain text.