Trustwave and Cybereason Merge to Form Global MDR Powerhouse for Unparalleled Cybersecurity Value. Learn More

Trustwave and Cybereason Merge to Form Global MDR Powerhouse for Unparalleled Cybersecurity Value. Learn More

Services
Managed Detection & Response

Eliminate active threats with 24/7 threat detection, investigation, and response.

Co-Managed SOC (SIEM)

Maximize your SIEM investment, stop alert fatigue, and enhance your team with hybrid security operations support.

Advisory & Diagnostics

Advance your cybersecurity program and get expert guidance where you need it most.

Penetration Testing

Test your physical locations and IT infrastructure to shore up weaknesses before exploitation.

Database Security

Prevent unauthorized access and exceed compliance requirements.

Email Security

Stop email threats others miss and secure your organization against the #1 ransomware attack vector.

Digital Forensics & Incident Response

Prepare for the inevitable with 24/7 global breach response in-region and available on-site.

Firewall & Technology Management

Mitigate risk of a cyberattack with 24/7 incident and health monitoring and the latest threat intelligence.

Solutions
BY TOPIC
Microsoft Security
Unlock the full power of Microsoft Security
Offensive Security
Solutions to maximize your security ROI
Rapidly Secure New Environments
Security for rapid response situations
Securing the Cloud
Safely navigate and stay protected
Securing the IoT Landscape
Test, monitor and secure network objects
Why Trustwave
About Us
Awards and Accolades
Trustwave SpiderLabs Team
Trustwave Fusion Security Operations Platform
Trustwave Security Colony
Partners
Technology Alliance Partners
Key alliances who align and support our ecosystem of security offerings
Trustwave PartnerOne Program
Join forces with Trustwave to protect against the most advance cybersecurity threats
Loading...
Loading...

PRB: Services will not start and/or errors occur after renaming a MailMarshal server

Expand / Collapse


This article applies to:

  • Trustwave MailMarshal (SEG)
    • Note: additional steps may be required in MailMarshal (SEG) 10.X.

Symptoms:

  • Services will not start and/or errors occur after renaming a MailMarshal standalone or Array Manager server.
  • Array Manager will not start.
  • Controller service cannot connect.
  • Error: 'Endpoint already in use'.
  • Spam Console and/or Admin Web Console do not work.
  • MailMarshal (SEG) 10 Management Console does not work.

Causes:

MailMarshal stores the server name in the registry, JSON file and database for connection purposes.  Additional configuration changes are required when the Array Manager (or standalone server) is renamed.

Note that this article does not cover renaming of an email processing server.

Information:

There are several issues that may result from changing the name of the SEG/MailMarshal Array Manager server.

  • Local database steps do not apply if the database is hosted on a different server, or if the server name is "localhost" or a valid IP address.
  • If the database is local, it will save time to stop the Array Manager service and set it to manual start before renaming the server.

Local Database (MailMarshal (SEG) 10.X only):

In a "basic" installation with SQL Express on the same server, the database connection to the TrustwaveConfigService database uses the server name. To update the connection:

  1. Open the SEG Config Service Admin Tool (SegCfgServiceAdminTool.exe) found in the Config Service subfolder of the SEG installation.
  2. On the Database page, update the SQL server name.
  3. Enter a user name and password. (The IIS application pool account credential is tied to a machine name and will no longer work.)
  4. Apply the changes.
  5. Open IIS Manager and recycle the SEG Config Service application pool.

The SEG Management Console website will now be available.

Local Database (All versions):

In a "basic" installation with SQL Express on the same server, the database connection to the SEG database (and the Syslog database if configured) uses the server name. To update the connection:

  1. Open the SEG Server Tool from the Start menu.
  2. Ensure that the Array Manager service and the Controller service (if present) are stopped.
    • The Array Manager may be stuck in a "starting" state for a few minutes as it attempts to connect using the old server name.
  3. On the Database page, update the SQL server name.
  4. If Syslog logging is enabled, also update the server name on the Syslog Database page
  5. Apply the changes.
  6. Start the Array Manager service. If you set it to manual start, remember to set automatic start.

The Configurator (or configuration functions of the MailMarshal (SEG) 10 Management Console) will now be available.

Service Starting Issues - Standalone Server

Issue #1 - Array Manager will not start

When the Controller service is installed on the same server as the Array Manager (a standalone MailMarshal installation), MailMarshal does not specify a port number for the Controller to listen on.  By default, it uses port 19002.  If the Controller service is on a different server from the Array Manager, it defaults to port 19001.  This configuration allows MailMarshal to open only one port (19001) in both directions when there is a firewall between the Array Manager and the Node.

When the server name is changed, the Controller uses the remote host mode, and defaults to listening on port 19001.  This presents a problem because the Controller service will be started first when the server restarts after the name change.  When the Array Manager tries to listen on port 19001, the error "endpoint already in use" appears in the event log and the Array Manager refuses to start.

To resolve this issue:

  1. Stop the Controller service (this will stop all the dependent services as well).
  2. Wait for port 19001 to be released by the operating system.  Run NETSTAT at a command prompt to confirm that the port is no longer in use.
  3. Once the port is free, start the Array Manager service.  The Array Manager will start now and MailMarshal Configurator will open.

Issue #2 - Controller cannot connect

At this point, the Controller service cannot connect to the Array Manager. 

To resolve this issue:

  • Important: Before starting the Controller, update the name of the server in the Configurator or Management Console. This preserves the Node ID of the local server.

    1. Open the MailMarshal Configurator or MailMarshal (SEG) 10 Management Console.
    2. Navigate to Server and Array Configuration (MailMarshal (SEG) 10: Mail Servers).
    3. Edit the server.
    4. Update the server name. For detailed steps see Help.
  • Re-connect to Array Manager: 
    1. In the Server tool navigate to the Node Array page.
    2. In the Node Port field enter 19002
    3. Select "Use the array on the local server" and select "Join this array".
    4. Enter the appropriate Windows credentials. For MailMarshal (SEG) 10 also enter an Array Join credential. Note that the default array join password does not change when the server name is changed.
    5. Click Apply.
    6. Start the Controller service. You can also start processing services in the Server tool, or in the Configurator/Management Console.

Website Connectivity (Standalone or separate Array Manager)

If the Spam Console or Admin Web Console do not work after the rename, you must update the web applications with the new information. (Admin Web Console is used in version 8.X and below only.)

For SEG/MailMarshal SMTP 6.4 and above, see Q12889

For MailMarshal SMTP 6.3 and below, use the Web configuration tool on the IIS server:

  1. Click Start | Programs | MailMarshal | MailMarshal Web Configuration Tool.
  2. On the Spam Quarantine Management tab, change the Server Name and  Site URL to reflect the new server name.

This article was previously published as:
NETIQKB41911

To contact Trustwave about this article or to request support:


Rate this Article:
     
Tags:

Add Your Comments


Comment submission is disabled for anonymous users.
Please send feedback to Trustwave Technical Support or the Webmaster
.