Rolling Back a Component Update in Cluster Environments Parent topic

If ScanMail has downloaded the current components, but you want to use a previous component, you can manually roll back the component update.

Procedure

  1. Take the ScanMail resource offline using the cluster management console.
  2. Stop the following ScanMail services:
    • ScanMail for Microsoft Exchange Remote Configuration Server (ScanMail_RemoteConfig)
    • ScanMail for Microsoft Exchange Master Service (ScanMail_Master)
  3. Delete all the files in the following folders:
    <Installation folder>\AU_Data\AU_Cache\
    <Installation folder>\AU_Data\AU_Temp\
    <Installation folder>\AU_Data\AU_Storage\
    <Installation folder>\web\activeupdate\
  4. Roll back the Smart Scan Agent pattern file, Virus pattern file, Spyware pattern file, IntelliTrap pattern file, and the IntelliTrap exception pattern file.
    1. Remove the most recently downloaded pattern files from this location:
      <Installation folder>\engine\vsapi\latest\pattern
    2. Remove the following files. Verify that ScanMail has already downloaded an older version of these files to which you can roll back.
      • The Smart Scan Agent pattern file:
        ex:icrc$oth.xxx
      • The Virus pattern file:
        ex:lpt$vpn.xxx
      • The Spyware pattern file:
        ex:ssaptn.xxx
      • The IntelliTrap pattern file:
        tmblack.xxx
      • The IntelliTrap exception file:
        tmwhite.xxx
      Where "xxx" refers to the latest pattern file download.
      For example: If you have recently downloaded Virus pattern file ex:lpt$vpn.345 and you want to roll back to a previous download pattern, ex:lpt$vpn.344, then delete ex:lpt$vpn.345 and ScanMail will begin to use ex:lpt$vpn.344.
    3. Delete all files in the following folders:
      <Installation folder\engine\vsapi\primary\pattern\
      <Installation folder\engine\vsapi\secondary\pattern\
  5. To roll back the anti-spam pattern file:
    1. Remove the latest pattern from following folder:
      <Installation folder>\engine\TMASE\latest\rule
      ex:tmxxxxxx.*
      "xxxxxx" means the latest version.
    2. Delete all files in the following folders:
      <Installation folder>\engine\TMASE\primary
      <Installation folder>\engine\TMASE\secondary
      <Installation folder>\engine\TMASE\latest\rule
      <Installation folder>\engine\TMASE\latest\cache
  6. Restart the following ScanMail services:
    • ScanMail for Microsoft Exchange Remote Configuration Server (ScanMail_RemoteConfig)
    • ScanMail for Microsoft Exchange Master Service (ScanMail_Master)
  7. Repeat steps 2 to 6 for each server in the cluster.
  8. Bring the ScanMail resource online using the PowerShell command below, or using the GUI. Right-click "<SMEX_Resource_Name>" then click Bring this resource online:
    cluster.exe group <ClusteredMailboxServer_Group_Name> /online