XmonSmtpAgent: Failed to process ON END OF HEADERS event

[davidenco 1]

Since installing ESMX v7, the following events are being logged into the Event Log on a regular basis. Any ideas why?

Log Name:      Application
Source:        ESET Reporting Service
Date:          29/08/2018 09:14:18
Event ID:      0
Task Category: None
Level:         Error
Keywords:      Classic
User:          N/A
Computer:      L1VS02XS.reades.local
Description:
XmonSmtpAgent: Failed to process ON END OF HEADERS event. System.NullReferenceException: Object reference not set to an instance of an object.
   at XmonAgent.XmonSmtpReceiveAgent.GetIpFromReceivedHdr(String& sOIp, IMailScannerServices& cMailScannerServices, EndOfHeadersEventArgs& args)
   at XmonAgent.XmonSmtpReceiveAgent.OnEndOfHeaderHandlerSpf(ReceiveMessageEventSource source, EndOfHeadersEventArgs args)
Event Xml:
<Event xmlns="hxxp://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="ESET Reporting Service" />
    <EventID Qualifiers="0">0</EventID>
    <Level>2</Level>
    <Task>0</Task>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2018-08-29T08:14:18.000000000Z" />
    <EventRecordID>6537662</EventRecordID>
    <Channel>Application</Channel>
    <Computer>L1VS02XS.reades.local</Computer>
    <Security />
  </System>
  <EventData>
    <Data>XmonSmtpAgent: Failed to process ON END OF HEADERS event. System.NullReferenceException: Object reference not set to an instance of an object.
   at XmonAgent.XmonSmtpReceiveAgent.GetIpFromReceivedHdr(String& sOIp, IMailScannerServices& cMailScannerServices, EndOfHeadersEventArgs& args)
   at XmonAgent.XmonSmtpReceiveAgent.OnEndOfHeaderHandlerSpf(ReceiveMessageEventSource source, EndOfHeadersEventArgs args)</Data>
  </EventData>
</Event>

 

[filips 43]

Hi davidenco,

The error in logs is caused by an exception while parsing "Received:" headers. We will address the issue in next hotfix of EMSX.

Could you PM me a procdump file(s) capturing the exception? It would help us to track it down:

procdump -ma -e 1 -f "nullreferenceexception" edgetransport.exe

 

[davidenco 1]

That command doesn't work. I have put procdump.exe into the V15/Bin folder and run that command but it just shows the help information for procdump. Any ideas?

[filips 43]

I updated the answer - there was a problem with encoding of some characters...

[davidenco 1]

Thanks, how much output do you need? I am seeing unhandled exceptions, format exceptions and so on right now.

[davidenco 1]

I have sent you a PM with the dump output as requested.

[filips 43]

This issue should be fixed in ESET Mail Security for Microsoft Exchange Server version 7.0.10020.0