GSE 7 p 1 + ENG 5400 : spam filte not working

[ATS-Groep]

We just update our GSE server with the new Engine
After installation the Anti-Spam filtering doesn't work anymore
Groupshield for Exchange 7.0.716.103 SP1
Engine 5400.1158
DAT 5730
Antispam Engine 8571
Antispam Rule 3141
VSE 8.7 sp 1 hf 464768
CMA 4.0.0 / 1345 (sp1)

Any ideas why spams are not filtered with the new engine ?

We remove and reinstall the Engine 5301.4018 and all works perfect

[petr.bohac]

Quite strange. I did upgrade it in my test environment (the same config like yours) and spam is being stopped as expected.

Did you check mail headers of your potential spam? Is there anything?

[petr.bohac]

Damn, you were right! I was bit experimenting with the Exchange cluster and all the spam is going through with the new engine. When I change it to the old version everything works fine as before.

Seems like McAfee screwed something ... again and again. Getting fed up with GSE sad

[ATS-Groep]

I just resolve the problem
1) remove all McAfee program form the exchange server (GSE7 + VSE87 + ASE 87 + CMA 4)
2) redeploy from ePO with new Engine (new installation)

Spam filter works fine.

BUT I detected another problem : each time that McAfee look for an update (planned to do it every hours on the exchange server) the groupshield service stop even if there are no update.

Result of that, the sstore.exe stopt every hours and restart after a minute, it means
1) store.exe never use the allocated memory, restarts every hours from 0kb and grows up to 2 GB and tehn restart again.
2) the users lose their exchange connection for a couple of minutes (generate a lot of calls to support - unhappy users)

workaround : change the update schema that McAfee looks for update outside business hours

[petr.bohac]

hm, this is something McAfee recommends for anything ... did you reinstall McAfee Whatever (gold support tier 1 & 2) ... ridiculous.

Ok, I didn't really tried that. However I'm not deploying GSE via ePO since it's not recommended and McAfee doesn't support that (this is change from 6.x version
). I know it works however they don't support it. In clustered environment.

What Exchange do you use Exc 2007 or 2003? I haven't seen such a behavior on 2003 SP2. And I think checking for update every 2 hours is too frequent ... since they release update just every day. Except they screw something :))

Anyway will try clean reinstall on my test env ... thanks for your update wink

[ATS-Groep]

I run MS Exchange 2007 (version 08.01.0393.001)

The advantage to use ePO is that you can manage all your McAfee products under one and unique console.
All your policies such as update, scans, spams, quarantine, etc are centralised and can be managed from remote stations.

[petr.bohac]

I know what's ePO ... been using it for the last 8 years 😉

I'm just saying that I can't manage clustered GSE 7.0.1 from the ePO. It works but not supported by McAfee thus if you run into some problems (as I did since integration with clustered Exchange 2003 is buggy), McAfee support tells you that this is unsupported and try to convince you to make changes. I was really tired of conversations with tier 1 & 2 support ... so that's it.