GFI Mail Essentials Debug Logs and disk fragmentation

I often find that the disk which has GFI Mail Essentials installed has fragmentation issues and the files that are fragmented are the Debug log files. These files are not needed unless you need to debug, but the setting is on by default and causes your disk to become fragmented.

I switch these off unless I need to debug and keep my drive from fragmenting. You can switch the debug logs off in the registry here

GFI MailEssentials version 2010(x86): - [HKEY_LOCAL_MACHINE\SOFTWARE\GFI\ME15\Config]
GFI MailEssentials version 2010(x64): - [HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432NODE\GFI\ME15\Config]
GFI MailEssentials version 14(x86): - [HKEY_LOCAL_MACHINE\SOFTWARE\GFI\ME14\Config]
GFI MailEssentials version 14(x64): - [HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432NODE\GFI\ME14\Config]
GFI MailEssentials version 12(x86): - [HKEY_LOCAL_MACHINE\SOFTWARE\GFI\ME12\Config]
GFI MailEssentials version 12(x64): -[HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432NODE\GFI\ME12\Config]
GFI MailEssentials version 11: - [HKEY_LOCAL_MACHINE\SOFTWARE\GFI\ME11\Config]
GFI MailEssentials version 10: - [HKEY_LOCAL_MACHINE\SOFTWARE\GFI\ME10\Config]
GFI MailEssentials version 9: - [HKEY_LOCAL_MACHINE\SOFTWARE\GFI Fax & Voice\ME9\Config]

A dword value named ‘debug’ should be found in this location. If the value does not exist a new DWORD value called ‘debug’ should be created manually.

Change the ‘debug’ dword value as follows:
To disable debug logging, change the ‘debug’ dword value to ‘0’
To enable debug logging, change the ‘debug’ dword value to ‘1’

Once complete restart the IISAdmin Services and GFI Mail Essentials Services. Then you can delete the actual log files.

ISAlog.bak and ISALog.bin

If you have a server with ISA Server 2004 installed you will find in the C: partition the files ISAlog.bak and ISALog.bin

These files will be approx 400MB in size and often taking up valuable disk space on an older system.

The files are not necessary and are for Microsoft PSS to use if you have a case open with them. You can remove these files by editing the registry key

HKLM\software\microsoft\isaTrace\BootTracing

Set this value to 0 and reboot the server, you can then delete the files manually and reclaim the disk space.

How to monitor for when an application terminates

I have had an application that needs to run on a SBS 2008 Server as an interactive user, the application runs from a mapped network drive and then runs from the system tray.

If the application is running it works fine, but it will on occasion terminate with no error, this means that emails do not get sent from the clients workstations and it can be hours before it is noted that the application is not running.

So I decided I needed to know if this application closes or terminates, I could then restart the application automatically and know that my users can still send emails.

I started by looking to see if I could run the application as a service so I did not need the server logged on with an interactive user, I used the SRVANY.EXE application from the Windows 2003 Resource Kit and then created a service using SC.EXE and set this to run my application as local system and interactive with the desktop.

This did run the service but the application did not load into the desktop and as a result did not work so I decided this was not the solution.

Next I looked for an application that would monitor a process and then alert when this occurred, I found Application Monitor here



This allows you to specify the application you want to monitor, how often it checks to see if it is running and then will restart the application if it detects that it is not running. I quickly setup the EXE as a check and tested by closing the application manually and the Application Monitor restarted the application!

There is no event log monitoring which would have been nice for our Managed Services application that could have notified our helpdesk, but it does work for a quick fix!

Snap shot delete stops at 95% on ESXi Server

I had taken a snapshot of a server pre Windows Updates and had not deleted this snapshot for four days, when I came to delete the snapshot I could see that the process had jumped to 95% and then stayed at this level for some considerable time.

This is by design, the snapshot is a differencing file and has to write the changes back to the VMDK file and so this takes some time to complete. Don't worry in this situation, just wait for the process to complete and this may take several hours!

Missing Toolbar in SharePoint Services 3.0

I had a customer today report that the Calendar List they had in Sharepoint 3.0 had suddenly gone missing. I looked at the site and I could see when I selected the Calendar list there was indeed no content or menu bar options for New, Action or Settings.

My first thought was that the List was probably still in Sharepoint but it had somehow got hidden, so I looked into the way to edit the page and find if the list had been hidden.

This is achieved but using the Site Actions, Edit Page option in the top right, you can then choose to Add a Web Part. At the bottom of the web parts list is the "Advanced Web Part gallery and options" link, choose this and a side bar opens and you are shown the option for Closed Web Parts.

In this Closed Web Parts was the Calendar List I was looking for, I added this back to the page and saved the changes and the Calendar was back in place.

Message rejected as spam by Content Filtering

We use a cloud based email security scanning service called GFI Max Mail Protection and on the whole this is a well priced and effective service. But recently my MD noticed that he no longer received his daily digest emails from the service.

I looked at the log files and I could see that his digest emails were being dropped with a NDR in the log files of 550.5.7.1 Message rejected as spam by Content Filtering.

I placed a support call as I couldn't think why his emails would be dropped as we use this is a our sole email scanning service, but it was a busy day and I didn't give it as much attention as I should have.

I get a email back from the GFI helpdesk to say, its my server that is dropping the emails, they checked their logs and could see my Exchange 2007 Server making the drop. A quick think and of course Content Filtering is part of Exchange 2007 Anti Spam features and naturally it was switched on!

This feature uses an algorithm to filter emails and it was seeing the digests as spam, probably because the digest contains HTML links to the emails so you can filter them manually. I quick switch off of this filter and my digests are being delivered again, which goes to show you should always have a good think on an issue before you fire off an email to the helpdesk!

Windows Disk Clean Up and SQL Database files

We had an issue today where users could not rollover a client in an application that used SQL Server Express 2005. The errors in the event log were listed as event ID 5118 and had the content.

The file "C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Data\MyDatabase.mdf" is compressed but does not reside in a read-only database or filegroup. The file must be decompressed.

The problem had been caused by the Disk Clean Up tool being used on this server and the option to compress old files had been used, this resulted in the MDF and LDF files being compressed and this error occurs.

I entered the properties for the files after stopping the SQLEXPRESS Service and then in the Advanced button in the file properties I chose to uncompress the files. Once I had restarted the SQLEXPRESS Service the database was available to use again.