Mail stuck in the Exchange Submission queue

Technical Articles ID: KB87809
Last Modified: 4/3/2018

Environment

McAfee Security for Microsoft Exchange (MSME) 8.5.1
Microsoft Exchange Server 2016, 2013, 2010
Microsoft Windows Server 2012, 2008

Problem

On the Exchange server with the hub role, mail can accumulate in the Exchange submission queue while MSME is running. The built-up mail might result in the following error messages being logged in the Windows Application Log:

1050 MSExchange Extensibility The execution time of agent 'McAfeeTxRoutingAgent' exceeded 30000 milliseconds while handling event 'OnCategorizedMessage' for message with InternetMessageId: 'Not Available'

ERROR...MSME,None,2045,,The OnAccess (Transport) scanner failed to scan the item 'SUB = email subject RPT = name@domain.com SDR = name@domain.com' with error 800402xx. ,None

Also, the <installation directory>\MSME\bin\temp folder might contain some .tmp files that show 0 bytes while the MSME service is running. When the MSME service is stopped, these files show their true file size.

Cause

Reasons why this problem can occur:

MSME 8.5.1 Hotfix 1179256 has not been applied.
An ePolicy Orchestrator (ePO) enforced On-Access settings policy that was upgraded from MSME 8.0 is assigned to the server. This policy is missing a value called OnProductFail, which MSME 8.5.1 is trying to load the value for, but cannot find it.
File Category filtering is enabled in the Password Protected bypass rule or other rules within the File Filter settings of MSME. These rules use a component called HP KeyView, which performs the true file type detection for MSME. Some Excel files can cause the HP KeyView component to hang, which prevents mail scanning from occurring.

Solution

Download and install MSME 8.5.1 Hotfix 1179256; this is considered a mandatory update.

PD27110 - Security for Microsoft Exchange 8.5.1 Hotfix 1179256 Release Notes

McAfee product software, upgrades, maintenance releases, and documentation are available from the Product Downloads site at: https://www.mcafee.com/enterprise/en-us/downloads/my-products.html.

NOTE: You need a valid Grant Number for access. See KB56057 - How to download Enterprise product updates and documentation for more information about the Product Downloads site, and alternate locations for some products.

NOTE: If the issue still occurs after you apply the hotfix, continue to the next solution.

Solution

To determine if the issue is caused by a missing OnProductFail value, perform one of these checks on the Exchange server:

Examine the McAfeeConfig.xml (<installation directory>\MSME\config\ ), scroll to the <VSAPI2 section (at the bottom of the page), and see if OnProductFail is missing. Below is an example of how a normal McAfeeConfig.xml file looks:

Enable debug logging in MSME, open the TransportscanX64_#.log, and look for the following:

04/10/16 09:40:28.588,7068,PropertyPath.cpp,446,m_pathOut is : VSAPI2.OnProductFail
04/10/16 09:40:28.588,7068,PropertyPath.cpp,446,m_pathOut is : VSAPI2.OnProductFail
04/10/16 09:40:28.588,7068,SAFeWrapper.cpp,1004,40201 returned by m_pConfig->GetProperty(pp, &avOnProductFailAction)
04/10/16 09:40:28.588,7068,AtomicValue.cpp,221,McAfee Exception 80040201 thrown

If the OnProductFail value is missing and MSME is ePO managed:

Launch the ePO console.
Go to Menu, Systems, System Tree.
In the left pane, select the group where the MSME policy is being applied.
Click Assigned Policies.
Click the drop-down button and select the MSME 8.5.0 policy.
In the row for On-Access Settings, click Edit Assignment.
Click the drop-down button and select My Default policy.
Save the changes.
Perform an agent wake-up call.
Close the ePO console.

When the policy has been received and is enforced on the Exchange server, ensure that the McAfeeConfig.xml now contains the OnProductFail="0" value as shown in the example above.

If the OnProductFail value is missing and MSME is not ePO managed:

Stop the MSME service.
Open explorer and go to the <installation directory>\MSME\config\ folder.
Open McAfeeConfig.xml in a text editor (notepad.exe).
Scroll down to the <VSAPI2 section and add the OnProductFail="0" to the line as shown below:

Save and restart the MSME service.

Workaround

Password-protected bypass rule or file category filter rule

IMPORTANT: The following steps are a workaround and should not be considered a permanent solution.

Use this workaround to temporarily process emails in a timely manner:

Click Start, All Programs, McAfee, McAfee Security for Microsoft Exchange Product Configuration.
In the left pane, click Policy Manager, On-Access, Policy (Master policy).
Click File Filtering.
In the File filtering rules and associated actions section, delete the rule named Password protected bypass rule.
If there are any additional rules listed in this section, click on each of the rule names.
Ensure that the Enable category filtering on the file filter rule page is deselected.
Click Apply.

Affected Products

Known Issue/Product Defect
Security for Microsoft Exchange 8.5

Languages:

This article is available in the following languages:

English United States
Spanish Spain
French
Italian
Portuguese Brasileiro

Glossary of Technical Terms

Highlight Glossary Terms

Please take a moment to browse our Glossary of Technical Terms.

Knowledge Center

Mail stuck in the Exchange Submission queue

Environment

Problem

Cause

Solution

Solution

Workaround

Affected Products

Languages:

Glossary of Technical Terms

Title

Title

Knowledge Center

Mail stuck in the Exchange Submission queue

Environment

Problem

Cause

Solution

Solution

Workaround

Affected Products

Languages:

Glossary of Technical Terms

Choose your region

Title

Title