Wednesday 27 August 2008

SEP, SBS and SIFMSMSE - they're tech not medical in case you were struggling

There was a time when I could remember what the Symantec antivirus acronyms were - life was simpler with SAVCE (Symantec Anti Virus Corporate Edition) and even SMSMSE (Symantec Mail Security for Microsoft Exchange). Now we've got SEP which doesn't remind you of an AV connection, worse still with the current version its SEP11 which just says its all coming crashing down. Then the latest Symantec Information Foundation Mail Security for Microsoft Exchange which just trips off the tongue, even the acronym SIFMSMSE is longer than most competitors' product names.

Anyway to the point. I've had an SBS2003R2 server running SEP 11.0 MR2 (I'm not even going to go there with the rest of the acronyms, but it was pre MP too) and SIFMSMSE 6.0.6 generating daily warnings in the Event Viewer which were making it into the SBS 6am daily monitoring report. The daily report didn't actually show much other than the source was Symantec AntiVirus. Taking a look in the Event Viewer shows Event ID 45 and screams SYMANTEC TAMPER PROTECTION ALERT. Turns out its Symantec's own product, the SIFMSMSE server which happily lives in the old SMSMSE directory.

Long story short, you can tell the antivirus to stop worrying about Symantec playing with itself (yes there was probably a more popular blog title in that) by going into SEP Console > Policies > Centralized Exceptions > right-click on the policy and choose Edit. Click Centralized Exceptions and add a Tamper Protection Exception for
with an action of ignore.

All quiet on the front now.

PS I do like Symantec products - one of the few - always worked well for me, although the complexity and management from an SBS point of view seems to be increasing significantly. Reminds me of the old MacAfee which just got too complex to manage quickly and easily for a small business - haven't touched that since.

Monday 25 August 2008

Allocated Memory - please sir, can I have some more

More! Couple of SBS2003 servers have spells of hitting me with daily allocated memory alerts, i.e. the warning threshold has been tripped in the monitoring. Now you can simply push that threshold figure up in the Server Management console, look under Monitoring and Reporting. Then Change Alert Notifications > Performance Counters > Allocated Memory and edit the figure up from say 2147483648 to 2447483648, i.e. another 300MB ish to go at before it starts screaming.

But if you look closely in the Task Manager and find that there are large memory allocations (170MB+) for sqlserver instances, you can adjust their figures.

Details on changing the maximum memory for a SQL instance, e.g. for the SBS Monitoring or the ISA Firewall or the Update Services can be found in the SBS team blog on troubleshooting high memory use.

There are some suggested figures to use from Susan's blog on throttling. They worked fine for me - one server regained 550MB and another around 200MB, with no apparent performance hits. Looked to me like it might be more relevant to pre-R2 servers, but that may have been coincidence.

Friday 22 August 2008

SBS Manchester meet 2008

Thursday's meeting of the SBS Partners group in Manchester was good. The group is several meetings down the line now and starting to feel like its got some direction. Great turn out from Microsoft with 4 people representing the company. In particular Gareth Hall, server product manager, and Emily Lambert, SBSC programme lead, who are heavily involved in the new SBS2008 launch and had plenty to tell us about what to expect in the next couple of months and how we could get involved. Certainly got me fired up for the new upcoming version.

Also pleased to meet Vijay who is the partner area lead for SBSC - think we'll just refer to him as the SBSC API ;-) Been keeping an eye on his iQubed blog for useful posts this year. Be good to see you up here again Vijay. BTW he seems to have more acronyms than Symantec.

(Hey Manchester got a mention :-)

The meeting isn't just about Microsoft either, we've got a range of partners from one-man to 20 staff so the peer support and discussion is varied and helpful. Next meeting is 18 September with some interesting third-party visitors from what I've heard. See you there.

Saturday 9 August 2008

SBS 2003 Monitoring Report cannot be displayed

Had a couple of Small Business Server (SBS) 2003 boxes throw up blank daily monitoring reports recently. Most servers have been ok apart from these two, both SBS 2003 R2 with WSUS 3.0 SP1. One's a home build basic PC spec and the other is a Dell PowerEdge 860 dual core with 2GB RAM.

I wasn't able to get a fix despite trying reboots, updates, disk checks, reconfiguring monitoring, SQL database checks, etc. Got a fix now thanks to advice from Les Connor a Canadian SBS MVP, see the link here.

Basically you need to go into the main WSUS console (from Admin Tools) then Options and Server Cleanup Wizard. Running this with just the first option for Unused Updates fixed both servers. The PowerEdge took 18 hours to complete - reporting unused updates 11,092 and revisions 3,830. Sounds like this WSUS maintenance needs to happen on a monthly/quarterly schedule to keep the server optimised.

The basic server crashed out at 19 hours with SQL timeout errors. The monitoring report didn't come back immediately, until after a reboot.

Both are happy again ... me included :-)

Trust 1&1 Internet for your domain name registration, from only £1.99/year!. Check now!