cancel
Showing results for 
Search instead for 
Did you mean: 

MSME 8.0 / Eventlog flooding with Error 2045

Jump to solution

Hello,

some days ago we have upgraded MSME from 7.6. to Version 8.0. Patch1;Rollup1 (8.0.7987.100) and also upgraded Exchange 2010 to Service Pack 3 Update Rollup 4.

Since then my application Eventlog is flooding with error 2045

Source MSME / EventID: 2045

The OnAccess (Transport) scanner failed to scan the item '<MessageSubject>' with error 80040236.

additionally every couple seconds the following event is shown in the application eventlog.

Source MSME / EventID: 2049

The Detected Items failed to store a record with error 80040230:McEFILEIOERROR  

MSME is only installed on servers with Exchange 2010 hubtransport role

I have already tried to recreate the MSMEData Folder as suggested in

http://kc.mcafee.com/corporate/index?page=content&id=KB73168

I also tried uninstalling the agent (C:\Program Files (x86)\McAfee\MSME\bin\E2007 Agents\Uninstall-Agent.ps1), restarted the Exchange Transport Service and reinstalled the Agent (C:\Program Files (x86)\McAfee\MSME\bin\E2007 Agents\Install-Agent.ps1) and restarted Exchange Transport Service again.

Couple seconds later the Events 2045 and 2049 re-appear.

Any help is much appriciated.

Sascha

1 Solution

Accepted Solutions

Re: MSME 8.0 / Eventlog flooding with Error 2045

Jump to solution

Hi all,

thank your for response. The issue is solved now by just moving the engine files from the DAT to the Engine folder

https://kc.mcafee.com/corporate/index?page=content&id=KB79521&actp=LIST

5 Replies
McAfee Employee tlange
McAfee Employee
Report Inappropriate Content
Message 2 of 6

Re: MSME 8.0 / Eventlog flooding with Error 2045

Jump to solution

its possible that something with the rollup didn't get applied properly and that is preventing msme from fully loading which is what the error is referring to.  the easiest way to see what is going on is to enable debug logging and then start the msme service up.  once started disable the logging, stop msme and upload the 2 rpcserv logs.

to Enable logging

if msme is stopped then open regedit to hklm\sofware\wow6432node\mcafee\msme\trace

set dword: Level to value 3  (to turn logging off just set value to 0)

set string: Path to a folder path (c:\debug)

start the msme service

if msme is on then open the gui

click settings & diagnostics \diagnostics

set level to high

select to specify a path and choose full path

provide path to a folder (c:\debug).  the folder will get created if it is there already.

stop / start msme service.

Re: MSME 8.0 / Eventlog flooding with Error 2045

Jump to solution

Hello,

i've followed your instruction and created the debug logs. I also replaced all email adresses in the logs with a dummy address.

Could you help me finding out whats going on here?

kind regards

Sascha

Reliable Contributor Aidan
Reliable Contributor
Report Inappropriate Content
Message 4 of 6

Re: MSME 8.0 / Eventlog flooding with Error 2045

Jump to solution

It doesn't look like a full set of logs but one of the logs suggests an issue loading our eservices.

If\When you stopped MSME there may have been orphaned processes.

Can you delete existing logs (in c:\debug if thats what you used).

Stop MSME service

Ensure following processes leave task manager - Safeservice.exe, RPCServ.exe (2) and all Postgres processes.

Set the level 3 in TraceKey again as TLange mentioned above.

Then start the MSME service again - wait for a few errors to appear in evt log - stop service (kill processes as above if necessary) and set Trace Key "Level" back to 0. 

We would need the full set of logs generated from this so maybe the best thing to do is get a case open directly with support so you can supply the full set. and MER.

If you have registered or can register for McAfee ServicePortal the case can be opened and managed by yourself ... https://support.mcafee.com

If not registerd as yet  you can get the WebMER Tool from Support Tools at same site (run it on MSME\Exchange machine make sure to select either all products or specifically Security for Microsoft Exchange) save this locally and have it ready for supply to the McAfee Agent dealing with your case.

Re: MSME 8.0 / Eventlog flooding with Error 2045

Jump to solution

Hi all,

thank your for response. The issue is solved now by just moving the engine files from the DAT to the Engine folder

https://kc.mcafee.com/corporate/index?page=content&id=KB79521&actp=LIST

Reliable Contributor Aidan
Reliable Contributor
Report Inappropriate Content
Message 6 of 6

Re: MSME 8.0 / Eventlog flooding with Error 2045

Jump to solution

Ok ... sorry bout the issue happening .... glad you got it sorted.

More McAfee Tools to Help You
  • How-to: Endpoint Removal Tool
  • Support: Endpoint Security
  • Visit: Business Service Portal
  • More: Search Knowledge Articles
  • ePolicy Orchestrator Support
  • The McAfee ePO Support Center Plug-in is now available in the Software Manager. Follow the instructions in the Product Guide for more.