Symantec Mail Security for Microsoft Exchange Management Pack Integration Guide

Symantec Mail Security for Microsoft Exchange Management Pack Integration Guide

Symantec Mail Security for Microsoft Exchange Management Pack Integration Guide The software described in this book is furnished under a license agreement and may be used only in accordance with the terms of the agreement. Documentation version 1.0 Copyright Notice Copyright 2006 Symantec Corporation. All Rights Reserved. Any technical documentation that is made available by Symantec Corporation is the copyrighted work of Symantec Corporation and is owned by Symantec Corporation. NO WARRANTY. The technical documentation is being delivered to you AS-IS, and Symantec Corporation makes no warranty as to its accuracy or use. Any use of the technical documentation or the information contained therein is at the risk of the user. Documentation may include technical or other inaccuracies or typographical errors. Symantec reserves the right to make changes without prior notice.no part of this publication may be copied without the express written permission of Symantec Corporation, 20330 Stevens Creek Blvd., Cupertino, CA 95014.

Contents Symantec Mail Security for Microsoft Exchange Management Pack Integration Guide About the Symantec Mail Security for Microsoft Exchange Management Pack... 5 Importing the management pack... 6 About the Symantec Mail Security for Microsoft Exchange rule group... 7 About Licensing rules... 7 About LiveUpdate rules... 8 About Outbreak rules... 9 About Performance rules... 9 About Rapid Release rules... 11 About Service rules... 11 Viewing the Symantec Mail Security for Microsoft Exchange rule group... 12 Disabling default rules... 13 Viewing Symantec Mail Security for Microsoft Exchange events and performance data... 14

4 Contents

Symantec Mail Security for Microsoft Exchange Management Pack Integration Guide About the Symantec Mail Security for Microsoft Exchange Management Pack The Symantec Mail Security for Microsoft Exchange Management Pack lets you integrate Symantec Mail Security for Microsoft Exchange events with Microsoft Operations Manager 2005 (MOM). Pre-configured Computer Groups, Groups, and Providers are automatically created when you import the management pack. These rules monitor specific Symantec Mail Security for Microsoft Exchange events in the Windows Event Log and the Windows Performance Monitor. When a rule is triggered, the Microsoft Operations Manager agent collects data about the event and forwards it to MOM. MOM provides you with a central repository that you can use to monitor critical events that occur on your Exchange servers. For more information about Microsoft Operations Manager 2005, see the Microsoft Operations Manager 2005 documentation. For more information about Symantec Mail Security for Microsoft Exchange, see the Symantec Mail Security for Microsoft Exchange Implementation Guide.

6 Symantec Mail Security for Microsoft Exchange Management Pack Integration Guide Importing the management pack Importing the management pack The system requirements for the computer on which you import the management pack are as follows: Microsoft Operations Manager 2005 Microsoft SQL Server 2005 Enterprise Edition The Microsoft SQL Server and SQL Agent services must be running when you install the management pack Microsoft Exchange 2000 Server/Exchange Server 2003 Windows 2000 Server/Windows Server 2003 The management pack is supported for Symantec Mail Security 5.x for Microsoft Exchange events only. The Microsoft Operations Manager agent must be deployed to the servers on which Symantec Mail Security for Microsoft Exchange is installed. This agent collects events and performance data and forwards the information to MOM. For information about deploying the Microsoft Operations Manager agent, see the Microsoft Operations Manager 2005 documentation. For information about how to remove the Symantec Mail Security for Microsoft Exchange Management Pack, see the Microsoft Operations Manager 2005 documentation. To import the management pack 1 Copy SMSMSE Management Pack.akm to the following folder: Program Files\Microsoft Operations Manager 2005\Management Packs 2 In the MOM 2005 Administrator Console, in the left pane, right-click Management Packs, and then click Import/Export Management Pack. 3 In the Pack Import/Export Wizard panel, click Next. 4 In the Import or Export Management Packs panel, click Import Management Packs and/or reports, and then click Next. 5 In the Select a Folder and Choose Import Type panel, click browse and select the following folder: Program Files\Microsoft Operations Manager 2005\Management Packs 6 Click Import Management Packs only, and then click Next. 7 In the Select Management Packs panel, select SMSMSE Management Pack.akm, and then click Next.

Symantec Mail Security for Microsoft Exchange Management Pack Integration Guide About the Symantec Mail Security for Microsoft Exchange rule group 7 8 Click Finish. 9 In the Import Status window, click Close when the program finishes importing the management pack. About the Symantec Mail Security for Microsoft Exchange rule group When you import the management pack, a Symantec Mail Security for Microsoft Exchange rule group directory structure is automatically created and populated with pre-configured rules. These rules are listed by category, such as LiveUpdate and Licensing. Each rule group category contains only one of the following types of rules: Event rules These are rules that collect data about specific critical events. The rule group categories that consist of event rules are as follows: Licensing See About Licensing rules on page 7. LiveUpdate See About LiveUpdate rules on page 8. Outbreak See About Outbreak rules on page 9. Rapid Release See About Rapid Release rules on page 11. Services See About Service rules on page 11. Performance rules These are rules that measure specific performance criteria. The Performance rule group consists of performance rules. See About Performance rules on page 9. For information about how to modify rules or create new rules, see the Microsoft Operations Manager 2005 documentation. About Licensing rules Table 1 lists the default Licensing rules and the events that trigger the rules.

8 Symantec Mail Security for Microsoft Exchange Management Pack Integration Guide About the Symantec Mail Security for Microsoft Exchange rule group Table 1 Default Licensing rules Antivirus License Error Invalid License - Console LiveUpdate Failed To Update Invalid License - LiveUpdate Failed to Update Invalid License - LiveUpdate Virus Definitions Not Updated Invalid License - Rapid Release Failed to Update Invalid Symantec Premium AntiSpam License Symantec Premium AntiSpam License Error Unable to Install Antivirus License Unknown Symantec Enterprise Licensing Error The content license expired or is not installed, or the license file is damaged. The content license expired or is not installed, or the license file is damaged. The content license expired or is not installed, or the license file is damaged. Your content license expired or is not installed, or the license file is damaged. Could not find a valid content license. The license file is expired, invalid, or damaged. The Symantec Premium AntiSpam license expired or is not installed, or the license file is damaged. The license file is expired, invalid, or damaged. The license file is expired, or the license file is damaged. About LiveUpdate rules Table 2 lists the default LiveUpdate rules and the events that trigger the rules. Table 2 Default LiveUpdate rules Console Communication Error with LiveUpdate LiveUpdate Critical Error An error occurred with LiveUpdate. The LiveUpdate server is temporarily unavailable, or the server has lost network connectivity. Check the Event Log for more information. The LiveUpdate server is temporarily unavailable, or the server has lost network connectivity.

Symantec Mail Security for Microsoft Exchange Management Pack Integration Guide About the Symantec Mail Security for Microsoft Exchange rule group 9 Table 2 LiveUpdate Error Default LiveUpdate rules (continued) The LiveUpdate server is temporarily unavailable, or the server has lost network connectivity. LiveUpdate Host Busy LiveUpdate No Carrier LiveUpdate Unknown Error Missing Virus Definitions Many people are attempting to access the LiveUpdate server simultaneously. The LiveUpdate server is temporarily unavailable. The LiveUpdate server is temporarily unavailable. Definition files are damaged or missing. About Outbreak rules Table 3 lists the default Outbreak rules and the events that trigger the rules. Table 3 Default Outbreak rules Outbreak Occurrence Outbreak Reoccurrence An outbreak threshold was reached. An outbreak is still occurring. About Performance rules Table 4 lists the default Performance rules and the events that trigger the rules. Table 4 Bytes Scanned Default Performance rules A byte was scanned. Provides the total number of bytes scanned since the statistics were last reset. Bytes Scanned/Sec A byte was scanned. Provides the total number of bytes scanned per second.

10 Symantec Mail Security for Microsoft Exchange Management Pack Integration Guide About the Symantec Mail Security for Microsoft Exchange rule group Table 4 Default Performance rules (continued) Encrypted Items Found An encrypted file was detected. Provides the total number of encrypted files detected since the statistics were last reset. Encrypted Items Found/Sec An encrypted file was detected. Provides the number of encrypted files detected per second. Filtering Violations Found A filtering violation was detected. Provides the total number of filtering rules violations detected since the statistics were last reset. Filtering Violations Found/Sec A content filtering violation was detected. Provides the number of content filtering violations detected per second. SMTP Files Scanned A SMTP file was scanned. Provides the total number of files scanned through SMTP since the statistics were last reset. SMTP Files Scanned/Sec A SMTP message was scanned. Provides the total number of files scanned through SMTP per second. SMTP Messages Scanned A SMTP message was scanned. Provides the total number of messages scanned through SMTP since the statistics were last reset. Unscannable Items Found An unscannable message or file was detected. Provides the total number of unscannable files detected since the statistics were last reset. Unscannable Items Found/Sec An unscannable message or file was detected. Provides the number of unscannable messages or files detected per second.

Symantec Mail Security for Microsoft Exchange Management Pack Integration Guide About the Symantec Mail Security for Microsoft Exchange rule group 11 Table 4 Violations Found Default Performance rules (continued) A violation was detected. Provides the total number of violations detected since the statistics were last reset. Violations Found/Sec A violation was detected. Provides the number of violations detected per second. Virus Violations Found A threat was detected. Provides the total number of threats detected since the statistics were last reset. Virus Violations Found/Sec A threat was detected. Provides the total number of threats detected per second. VSAPI Files Scanned A file was scanned through VSAPI. Provides the total number of files scanned through VSAPI since the statistics were last reset. VSAPI Files Scanned/Sec A file was scanned through VSAPI. Provides the total number of files scanned through VSAPI per second. About Rapid Release rules Table 5 lists the default Rapid Release rules and the events that trigger the rules. Table 5 FTP Failure Default Rapid Release s An FTP failure occurred. General Error During Rapid Release Unknown. Check the Event Log for more information. About Service rules Table 6 lists the default Services rules and the events that trigger the rules.

12 Symantec Mail Security for Microsoft Exchange Management Pack Integration Guide About the Symantec Mail Security for Microsoft Exchange rule group Table 6 Default Services rules Auto-Protect Process Failed to Start Out of Memory Quarantine is Full Service Could Not Start Service Could Not Start - Already Started Service Could Not Start Auto-Protect Process Not Started Service Could Not Start - Configuration Invalid Service Could Not Start - Cannot Logon to the Exchange Server Service Could Not Start - Low Memory Conditions Service Could Not Start - Not Admin Account Service Stopped Unable to Record Events Check the Event Log for more information. Computer resources are low. The Quarantine Server contains too many quarantined files. Check the Event Log for more information. An attempt was made to start the service, but the service is already running. The Symantec Mail Security for Microsoft Exchange service cannot start. The program settings could not be obtained or are invalid. Unable to logon to the Exchange server. There is not enough memory to start the service. The NT account specified does not have administrator privileges. The computer was restarted or shut down. The Event Log is full. Viewing the Symantec Mail Security for Microsoft Exchange rule group You can view the default Symantec Mail Security for Microsoft Exchange rule group in the MOM 2005 Administrator Console. Each rule contains a Knowledge Base that provides the following information: Summary Cause Resolution A brief description of the rule What event triggered the rule Proposed resolutions for resolving the event issue

Symantec Mail Security for Microsoft Exchange Management Pack Integration Guide Disabling default rules 13 To view the Symantec Mail Security for Microsoft Exchange rule group 1 In the MOM 2005 Administrator Console under Management Packs, in the left pane, expand Groups, expand Symantec, and then expand Symantec Mail Security for Microsoft Exchange. 2 Expand any of the following categories to view the rules that are available for that category: Licensing LiveUpdate Outbreak Performance Rapid Release Services To view a rule's Knowledge Base 1 In the left pane, select the rule type that contains the rules for that category. For example, for the Licensing category, select Event s. For the Performance category, select Performance s. See About the Symantec Mail Security for Microsoft Exchange rule group on page 7. 2 In the right pane, double-click the rule. 3 In the Properties dialog box, click the Knowledge Base tab. Disabling default rules All of the Symantec Mail Security for Microsoft Exchange rules are enabled by default. You can disable the rules that you do not want to apply. To disable default rules 1 In the MOM 2005 Administrator Console under Management Packs, in the left pane, expand Groups, expand Symantec, and then expand Symantec Mail Security for Microsoft Exchange. 2 Select a rule category and a rule type. For example, for the Licensing category, select Event s. For the Performance category, select Performance s. 3 In the right pane, double-click the rule that you want to disable.

14 Symantec Mail Security for Microsoft Exchange Management Pack Integration Guide Viewing Symantec Mail Security for Microsoft Exchange events and performance data 4 In the Event Properties dialog box, uncheck This rule is enabled. 5 Click OK. Viewing Symantec Mail Security for Microsoft Exchange events and performance data You can view Symantec Mail Security for Microsoft Exchange events and performance data in the Microsoft Operations Manager Operator Console. The Events view contains the following rule violations: Licensing, LiveUpdate, Outbreak, Rapid Release, and Services. The Performance view contains Performance rule data. To view Symantec Mail Security for Microsoft Exchange events 1 In the Operator Console, in the Views pane, click Events. 2 In the Event Views pane, expand All:Event Views, expand Symantec, and then expand Symantec Mail Security for Microsoft Exchange. 3 Click SMSMSE Events. The events appear in the SMSMSE Events pane. 4 Select an event to view detailed information. The details appear in the Event Details pane. To view Symantec Mail Security for Microsoft Exchange performance data 1 In the Operator Console, in the Views pane, click Performance. 2 In the Performance Views pane, expand All:Performance Views, expand Symantec, and then expand Symantec Mail Security for Microsoft Exchange. 3 Select the Performance rule that contains the specific criteria that you want to review. The performance data appears in the SMSMSE Performance Data pane.