It might seem that errors in IT systems related to the change of the year are the domain of the past (e.g. known the problem of the year 2000). Meanwhile, not entirely, because users of Microsoft Exchange, i.e. an e-mail solution used mainly in companies, they report today such errors:
The FIP-FS „Microsoft” Scan Engine failed to load. PID: ХХХХХ, Error Code: 0x80004005. Error Description: Can’t convert „2201010001” to long.
(…)
Since the service is interconnected with the transport service, mail stops coming in and out, respectively.
FIP-FS is an anti-virus scanner included for the first time with Exchange version 2013. It provides at least basic protection of mailboxes by scanning the mail content for various malware. Due to the above-mentioned error, it is impossible to load it into memory, thus blocking the operation of e-mail in environments using Exchange. While in many cases this is not a serious problem during the holiday season, in some industries production must run practically without interruption. On the other hand, essential services should be provided with HA, however, mail maintenance is generally a compiled issue.
As noted in this tweecie, the maximum value of the long type is 2147483647, which is not necessarily a good type of time variable, especially in the format used in Exchange. The date January 1, 2022 “jumped” beyond this range, causing a fairly serious error (its occurrence caused the whole to “spill”).
There is no official solution to the problem yet, but an effective workaround, according to many users, is to temporarily disable the scanner with the Disable-AntiMalwareScanning.ps1 script and restart the MSExchangeTransport service (theoretically just using the script should force a restart).
Creators of similar solutions should pay attention to such cases. In this situation, the use of a variable of a different type should be considered, but it is worth testing various scenarios (including the program’s responses to the change of the year), because thanks to this, other, probably more complicated errors can also be detected. The Exchange itself already contained a serious one susceptibility named ProxyLogon enabling RCE.
Testing different scenarios in separate environments is also an important task for administrators. You should definitely not rely on one supplier, rather try to use different components. In the case of mail, you can also consider keeping it outside instead of in your own infrastructure, which can save a lot of time and is often also profitable. A good solution is to use HA, i.e. ensuring the continuity of operation (SLA) of the system when one of its components is not working. This does not mean a failure of a given component of the environment, but also standard administrative work, which ideally should not affect the operation of the system. There should definitely be no SPOF, single points of failure, i.e. an element whose unavailability causes the whole to stop working.
–Michał Giza
–
