Earlier today I saw some strange behavior with Intelligent Message Filter (IMF) v2. Incoming internet mail wasn't getting scanned by IMF. Outlook wasn't showing *any* SCL values with any messages at all!
That in itself wasn't the strange part. I'm positive I have the right gateway and store thresholds, and I have IMF enabled on the SMTP virtual server - double-checked that as soon as I saw the issue.
Next stop - check the IMF performance counters. A word about monitoring SMTP (and IMF in particular) with perfmon - the default view is a graph, and if you're dealing with a server that doesn't get much traffic (the server in question being my primary Exchange server on the home network - it doesn't get hundreds of messages on a Sunday night), it's simpler to simply switch to the Report view and just look at the numbers. Could potentially save a lot of time, as it often does for me.
Quickly added the following counters of
MSExchange Intelligent Message Filter object:
1.
Total Messages Scanned for UCE2.
Messages Scanned for UCE/sec
3.
%UCE of Total Messages Scanned
4.
%UCE of Messages Scanned in the previous 30 minutes Also added the following from
SMTP Server object:
1.
Messages Received Total
2.
Messages Received/secWith the Report view fired up, I started sending messages - some with all the characteristics of UCE, and some simple test messages. And here's where the strange behavior comes in - SMTP Messages Received counters were rising, and surprisingly so were Total Messages Scanned for UCE. However, Outlook still didn't show any SCL values and all the obvious spam was still hitting my Inbox!
Here's where another important IMF counter comes in -
Total UCE Messages Acted Upon (and its sibling -
UCE Messages Acted Upon/sec). Added these and spent a few minutes sending some more messages. The latter counters did not move at all, whereas Total Messages Scanned was inching higher.
IMF was scanning, but not acting on those messages!
Next stop (and don't ask me why this wasn't the first thing I checked :) - Event Logs. The familiar 7514 that I was trying to reproduce for another test during earlier part of the day showed up. This is an error logged by MSExchangeTransport. Description: An error occurred while loading Microsoft Exchange Intelligent Message Filter. The error code is 0x80004005
It was caused by saving the MSExchange.UceContentFilter.xml file as text. This file is used by the new Custom Weighting feature introduced with IMF v2 in SP2. It needs to be saved with encoding set to Unicode.
Opened file in notepad, changed to Unicode and saved. Restarted smtpsvc. More test messages - now I could instantly see the messages acted upon counter rising. Spam started showing up in Junk Mail and Outlook started showing the SCL values, as expected.
Labels: IMF, SMTP