We've just started using Symantec Mail Security for SMTP 5.0 on a Windows 2003 Server SP1 Standard Edition system. Our hard drive is quickly filling as every few minutes (or less) the svchost.exe program executes a "svchost.exe -k WinErr" and two files appear in "C:\WINDOWS\PCHEALTH\ErrorRep\UserDumps" with names like "filter-hub.exe.20060722-154150-00.mdmp" (usually about 17 MB) and "filter-hub.exe.20060722-154150-00.hdmp" (usually about 115 MB - seemingly the size in memory of Symantec's filter-hub.exe program).
This continues on and on until very little space is left on the hard drive, at which point smtp connections stop being accepted, and no mail comes through. Incidentally, if you telnet to the smtp port you get back a "432 Please try again later" message back at that time.
I've tried rebooting. I've tried turning of the "Error Reporting" in the "System Properties" window (right click My Computer, then Properties, then Advanced, then Error Reporting). That didn't seem to stop it either.
So, it sounds to me like the filter-hub application is crashing, but perhaps auto restarting, and quite regularly? I have seen a few (very few) "filter-hub.exe has crashed, send this to Microsoft" type pop ups, but not in several days.
I should also mention that CPU utilization reports at 100% for long stretches - sometimes 20 seconds, sometimes a minute or two. This is followed by a brief "rest" in the 40% range (which seems to be where it operates normally). The 100% utilization even occurs while connections are not being accepted. The conduit.exe application takes about 30 to 40 percent, but its the svchost.exe app that seems to peg the cpu utilization. Also, filter-hub.exe is often using 90% or more when the machine is reporting full utilization.
Any thoughts? Right now I'm manually running a batch file to delete those hdmp and mdmp files - ugh! I'm also in the process of building another server to see if it has the same problem. Lastly, I'll mention its running with 1.5 GB of memory and the OS is on a VMWare ESX 2.5 server with local hard drive storage.