Subsequent COBRAS Exports fail, subscribers not found

Question

4.2(1)Unity Voicemail Only with Dedicated Offbox Exchange Message Store. Failover Monitor indicates this server VM01 is Running;Active.
First time I ran COBRAS it found the 985 subscribers and took 1 hr 30 minutes.
================================================================
Running COBRASExport, version 7.0.106
Running COBRAS Export logged in as: VM\svc_unitymsg
Local Unity version=4.2(1.0)
Local Unity server name=VM01
Local subscriber count=985
Local call handler count=31
Local distribution list count=11
Local interview handler count=2
Local routing rules count=8
Local time=5/17/2011 8:12:10 PM
Second and other times I run COBRAS it doesn't find the subsribers and takes 10 minutes
================================================================
Running COBRASExport, version 7.0.106
Running COBRAS Export logged in as: VM\svc_unitymsg
Local Unity version=4.2(1.0)
Local Unity server name=VM01
Local subscriber count=0
Local call handler count=0
Local distribution list count=0
Local interview handler count=0
Local routing rules count=0
Local time=5/21/2011 7:00:00 PM
Why is COBRAS no longer finding subscribers?

Answer 1

Cripes, I found the problem. Someone turned CSA back on….
Event Type:        Information
Event Source:    CSAgent
Event Category:                Kernel Rule
Event ID:              256
Date:                     5/22/2011
Time:                     7:13:57 PM
User:                     N/A
Computer:          VM01
Description:
The process 'D:\Program Files\Cisco Systems\COBRAS\COBRAS Export for Unity\COBRASExport.exe' (as user VM\svc_unitymsg) attempted to call the function OpenProcess("D:\Program Files\Cisco Systems\COBRAS\COBRAS Export for Unity\wavcat.exe") from a buffer (the return address was 0x503f7d). The code at this address is '088b0851 6aff6800 001000e8 4f41f1ff 8945d4ff 157c1040 008b55d4 8955dcc7' This either happens when a process uses self-modifying code or when a process has been subverted by a buffer overflow attack. The user was queried and a 'Terminate' response was received. The response was the default taken after a timeout.