Symantec Mail Security for Exchange (SMSMSE) continuously reports Windows application event ID 25 "Updated Virus Definitions" and is not using current virus definitions when multiple copy processes occur at the same time
The SMSMSE Administration Console shows a virus definitions date that is older than one or two days. However the Windows Application event log shows repeated events showing the virus defintions have been updated.
To view the virus definition date used by SMSMSE perform the following steps:
1. Open the SMSMSE Administration Console. 2. On the Home tab the label Virus Definition Date is the date of the virus defintions used by SMSMSE.
Windows Application Event Log Shows Event ID 25 every ten (10) to twenty (20) minutes:
Log Name: Application Source: Symantec Mail Security for Microsoft Exchange Date: 5/12/2011 2:34:24 PM Event ID: 25 Task Category: LiveUpdate/Rapid Release Level: Information Keywords: Classic User: N/A Computer: 2K8R2.Exchange2010.internal Description: Updated virus definitions.
The Windows Application Event log may show this event:
Log Name: Application
Source: Symantec Mail Security for Microsoft Exchange
Date: 5/12/2011 3:00:54 PM
Event ID: 404
Task Category: LiveUpdate/Rapid Release
Virus definitions are 6 days old. To remain protected ensure that Liveupdate is working properly.
The SAVFMSETask.exe process and SAVFMSESp.exe process have embedded CSAPI library. When these processes start up or on a scheduled interval, the CSAPI library checks for new antivirus updates. If one is found then the CSAPI library copies them from the Hawking to the CSAPI directory. If two different processes attempt to do this copy at the same time they cause interference and the copy process does not succeed.