Subsequent COBRAS Exports fail, subscribers not found

[Jason Aarons]

4.2(1)Unity Voicemail Only with Dedicated Offbox Exchange Message Store. Failover Monitor indicates this server VM01 is Running;Active.

First time I ran COBRAS it found the 985 subscribers and took 1 hr 30 minutes.

================================================================
Running COBRASExport, version 7.0.106

Running COBRAS Export logged in as: VM\svc_unitymsg
Local Unity version=4.2(1.0)
Local Unity server name=VM01
Local subscriber count=985
Local call handler count=31
Local distribution list count=11
Local interview handler count=2
Local routing rules count=8
Local time=5/17/2011 8:12:10 PM

Second and other times I run COBRAS it doesn't find the subsribers and takes 10 minutes

================================================================
Running COBRASExport, version 7.0.106

Running COBRAS Export logged in as: VM\svc_unitymsg
Local Unity version=4.2(1.0)
Local Unity server name=VM01
Local subscriber count=0
Local call handler count=0
Local distribution list count=0
Local interview handler count=0
Local routing rules count=0
Local time=5/21/2011 7:00:00 PM

Why is COBRAS no longer finding subscribers?

[Jason Aarons]

Cripes, I found the problem. Someone turned CSA back on….

Event Type:        Information

Event Source:    CSAgent

Event Category:                Kernel Rule

Event ID:              256

Date:                     5/22/2011

Time:                     7:13:57 PM

User:                     N/A

Computer:          VM01

Description:

The process 'D:\Program Files\Cisco Systems\COBRAS\COBRAS Export for Unity\COBRASExport.exe' (as user VM\svc_unitymsg) attempted to call the function OpenProcess("D:\Program Files\Cisco Systems\COBRAS\COBRAS Export for Unity\wavcat.exe") from a buffer (the return address was 0x503f7d). The code at this address is '088b0851 6aff6800 001000e8 4f41f1ff 8945d4ff 157c1040 008b55d4 8955dcc7' This either happens when a process uses self-modifying code or when a process has been subverted by a buffer overflow attack. The user was queried and a 'Terminate' response was received. The response was the default taken after a timeout.