Resetting MIMEsweeper LDAP lists

Anthony Drewery — Thu, 03 Aug 2006 09:31:12 +0000

Another problem we get from time to time with MIMEsweeper for SMTP 5.2 is corruption of the LDAP lists. This initially manifests itself with an error like this in the event log on the configuration server:

———————————
Event Type: Error
Event Source: InfrastructureService
Event Category: (539)
Event ID: 10265
Date: 27.07.2006
Time: 11:47:28
User: N/A
Computer: CRWEXMSW1
Description:The PCS LDAP node configuration processor was unable to update the consolidated digest file for the PCS LDAP address list ’78f39c28-cf8c-440c-84ac-67e4533c4f4c’.
The domain index file for the address list ‘PMM Users’ is invalid.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
———————————

If you reboot the configuration server you’ll find that the Infrastructure Service won’t start. If you run pmi.is.exe -debug you will see errors relating to PCS LDAP in the output.

To fix this try the following:

Stop all the MIMEsweeper services on the PCS.

Move the files in the following folders to a safe location.

C:\Program Files\Clearswift\MIMEsweeper for SMTP\Data\Configuration\Server\PcsLdapAddressLists

C:\Program Files\Clearswift\MIMEsweeper for SMTP\Data\Operations\Configuration\PcsCache\PcsLdapAddressLists

Restart the MIMEsweeper services.

Now go into your policy editor and update all of your LDAP lists. Once this is complete save/apply your policy.

[tags]MIMEsweeper[/tags]

Resetting the MIMEsweeper SpamLogic database

Anthony Drewery — Mon, 31 Jul 2006 09:38:52 +0000

We run Clearswift’s MIMEsweeper for SMTP 5.2 as our SMTP gateway. We have 4 policy servers (2 x Tampa, 2 x Crawley) connected to one configuration server (Crawley). I’ll spare you my rant about Clearswift and MIMEsweeeper but suffice to say I won’t be recommending it to anyone who needs a reliable messaging hygiene solution for a high volume enterprise environment. (FWIW, I’ve been working with MIMEsweeper since 1998 and until its current incarnation have always been a stong supporter of the product.)

We’ve had a plethora of issues with MIMEsweeper version 5 but one in particular keeps re-occurring. Despite having applied their hotfix, every few weeks MIMEsweeper’s spam solution, SpamLogic, takes on a mind of it’s own and starts trapping an unacceptable amount of false positives. When this happens the SpamLogic databases need to be reset to their default configuration. To do this connect to each policy server in turn and do the following:

Go to the c:\Program Files\Clearswift\MIMESweeper for SMTP\Data\SpamLogic folder.
Rename spamlogic.db to spamlogic.old.
Copy spamlogic.bak to spamlogic.db.

This way the original spamlogic.bak is preserved as you’re going to be needing it again in the future! Once you’ve completed these steps restart the MIMEsweeper Security Service.

You can disable the SpamLogic auto-training feature at anytime but then your databases will remain static and your detection rates drop as the type of spam evolves.

[tags]MIMEsweeper[/tags]

Ant Drewery » MIMEsweeper

Resetting MIMEsweeper LDAP lists

Resetting the MIMEsweeper SpamLogic database