6 Replies Latest reply: May 29, 2013 3:50 PM by tlange RSS

    MSME 7.6 alert - RPCServ process stopped responding

    dq72

      From what I can tell the services seem to be up and running, mail is still be scanned, but I can't find any further details on this mcafee alert we received.

      Does anyone have any information on this one?

       

      Process RPCServ.exe stopped responding on '12/04/2012 14:45:32'.

      1. Check product logs for RPCServ re-creation if not.
      2. Check whether the processes SAFeService.exe, RPCServ.exe, and postgres.exeare started.
      3. Check the Windows Event Log for more details.
      4. Please contact McAfee Technical Support.

        • 1. Re: MSME 7.6 alert - RPCServ process stopped responding
          Aidan

          Do this happen around same time as your Quarantine DB message in your other post??

          Is there any indication in Product Log or Event log that RPCServ actually crashed??

          (any DrWatson/win error reporting on an RPCserv issue??)  

          • 2. Re: MSME 7.6 alert - RPCServ process stopped responding
            dq72

            This morning at 6:30 we did have corresponding messages:

            Process RPCServ.exe stopped responding on '12/05/2012 06:29:44',   as well as ".....Product database failed to store a record"  at 6:30.

             

            The windows application logs show the following at 6:29

             

            The OnAccess (VSAPI) scanner failed to scan the item '' with error 8004020a.

             

            The OnAccess (VSAPI) scanner failed to scan the item '' with error 8004020a.

            The OnAccess (VSAPI) scanner failed to scan the item '' with error 8004020b.

            The OnAccess (VSAPI) scanner failed to scan the item '' with error 8004020b.

            The OnAccess (VSAPI) scanner failed to scan the item '' with error 8004020a.

            The OnAccess (VSAPI) scanner failed to scan the item '' with error 8004020b.

            The OnAccess (VSAPI) scanner failed to scan the item '' with error 8004020b.

            The Detected Items failed to store a record with error 80040230:McEFILEIOERROR

            The Detected Items failed to store a record with error 80040230:McEFILEIOERROR

            The Detected Items failed to store a record with error 80040230:McEFILEIOERROR

            The Detected Items failed to store a record with error 80040230:McEFILEIOERROR

            The OnAccess (VSAPI) scanner failed to scan the item 'ATT78076 1.jpg' with error 8004021a.

            The OnAccess (VSAPI) scanner failed to scan the item '' with error 8004021a.

            The Detected Items failed to store a record with error 80040230:McEFILEIOERROR

             

            There is no indication that the RPCserv service actually crashed.

             

             

            • 3. Re: MSME 7.6 alert - RPCServ process stopped responding
              Aidan

              Do you already have MSME 7.6 Patch 1 installed?? How to verify that Security for Microsoft Exchange 7.6 Patch1 is installed (KB76286)

              If you do then I would advise opening a case with Support for this incident.

              • 4. Re: MSME 7.6 alert - RPCServ process stopped responding
                dq72

                We do have Patch 1 installed, so I'll touch base with McAfee again and open an ticket.

                • 5. Re: MSME 7.6 alert - RPCServ process stopped responding
                  alexn

                  Any one knows the real cause of this issue? (MSME 7.6 Rollup2 applied and start getting these errors )

                   

                  Is it something related to registry,OnAccess Scanner is failing to scan file xxxxxxxx .

                   

                  on 5/29/13 11:18:47 AM CDT
                  • 6. Re: MSME 7.6 alert - RPCServ process stopped responding
                    tlange

                    the reason for the error isn't going to be due to any one thing.  we would need to look at the logs to see what might have occurred when the errors started.  if you haven't done so i would suggest to open a ticket with support.  also if the issue is happening regularly then set the debug logging for msme and try to capture logs while the issue is occurring.