Fergusmac
asked on
Exchange 2003 Groupshield has stripped all the message body from existing emails
OK, I'm in deep doo-doo
Had someone phone me up yesterday regarding a problem with hard drive space. A quick look realised they hadn't done a backup for years and the log files were at 6 GB (the database files only totalled about 1Gb). I said about how backing up flushes the log files and it should really be done nightly..blah blah blah, but the quickest thing to do would be to move the location of the log files (they had a drive with about 50GB of space). I open System Manager, drilled down to the server, opened up the properties, changed the location for the transaction log files and watched everything work as it should do, log files were moved, stores re-mounted and hey presto they have another 6GB of space available.
Later yesterday afternoon I get a call from a user who says when they open an email there's nothingin it, the message body has been stripped out. I ask them to check using OWA to confirm it's not an Outlook problem which it isn't. After about an hour of investigation it turns out that McAfee Groupshield seems to be the culprit, in the detected items I can see all the emails and it has "removed" them as they can't be scanned, in 5 hours it has removed over 10,000 items.
McAfee = no help, I can see the items and choose to forward them (as it can only be done individually, it might take a while).
Is there a way of reversing the process through Groupshield or forwarding all of them at the same time?, Will re-running the log files into the existing database be an option, not sure if they'll do anything as the database is still full of emails, just empty ones. Am I better off trying to create a new database and run the eseutil /cc on the new database?
Any help greatly appreciated.
Had someone phone me up yesterday regarding a problem with hard drive space. A quick look realised they hadn't done a backup for years and the log files were at 6 GB (the database files only totalled about 1Gb). I said about how backing up flushes the log files and it should really be done nightly..blah blah blah, but the quickest thing to do would be to move the location of the log files (they had a drive with about 50GB of space). I open System Manager, drilled down to the server, opened up the properties, changed the location for the transaction log files and watched everything work as it should do, log files were moved, stores re-mounted and hey presto they have another 6GB of space available.
Later yesterday afternoon I get a call from a user who says when they open an email there's nothingin it, the message body has been stripped out. I ask them to check using OWA to confirm it's not an Outlook problem which it isn't. After about an hour of investigation it turns out that McAfee Groupshield seems to be the culprit, in the detected items I can see all the emails and it has "removed" them as they can't be scanned, in 5 hours it has removed over 10,000 items.
McAfee = no help, I can see the items and choose to forward them (as it can only be done individually, it might take a while).
Is there a way of reversing the process through Groupshield or forwarding all of them at the same time?, Will re-running the log files into the existing database be an option, not sure if they'll do anything as the database is still full of emails, just empty ones. Am I better off trying to create a new database and run the eseutil /cc on the new database?
Any help greatly appreciated.
ASKER CERTIFIED SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Secondly - no, replaying the log files etc. won't work.
thirdly - i guess you never did get that backup?
fourthly - what version of groupshield?