Earlier today I saw some strange behavior with Intelligent Message Filter (IMF) v2. Incoming internet mail wasn’t getting scanned by IMF. Outlook did not show the SCL values for any message!
That in itself wasn’t the strange part. I’m positive I have the right gateway and store thresholds, and I have IMF enabled on the SMTP Virtual Server – I double-checked that as soon as I saw the issue.
Next stop – check IMF performance counters. A word about monitoring SMTP (and IMF in particular) with Perfmon— the default view is a graph, and if you’re dealing with a server that doesn’t get much traffic (the server in question being my primary Exchange server on the home network – it doesn’t get hundreds of messages on a Sunday night), switching to the Report view and looking at the numbers makes it much easier to detect any activity. This could potentially save a lot of time, as it often does for me.
I quickly added the following counters of MSExchange Intelligent Message Filter object:
- 1. Total Messages Scanned for UCE
- 2. Messages Scanned for UCE/sec
- 3. %UCE of Total Messages Scanned
- 4. %UCE of Messages Scanned in the previous 30 minutes
Also added the following from SMTP Server object:
- 1. Messages Received Total
- 2. Messages Received/sec
With the Report view fired up, I started sending messages – some with all the characteristics of UCE, and some simple test messages. Here’s where the strange behavior comes in – the SMTP Messages Received counters were rising, and surprisingly so were Total Messages Scanned for UCE. However, Outlook still didn’t show any SCL values and all the obvious spam was still hitting my Inbox!
Here’s where another important IMF counter comes in – Total UCE Messages Acted Upon (and its sibling – UCE Messages Acted Upon/sec). Once these were added to the Perfmon console, I spent a few minutes sending some more messages. The UCE Messages Acted Upon counters did not move at all, whereas Total Messages Scanned was inching higher.
IMF was scanning, but not acting on those messages!
Next stop (and don’t ask me why this wasn’t the first thing I checked :) – Event Logs. The familiar Event ID 7514 that I was trying to reproduce for another test earlier in the day showed up in the Application Event Log! This is an error logged by MSExchangeTransport. Description: An error occurred while loading Microsoft Exchange Intelligent Message Filter. The error code is 0x80004005.
The error was caused by saving the MSExchange.UceContentFilter.xml file as text. This file is used by the new Custom Weighting feature introduced with IMF v2 in SP2. The file needs to be saved with encoding set to Unicode.
Figure 1: The Custom Weighting file MSExchangeUceContentFilter.xml should be saved in Unicode format
Opened file in notepad, changed to Unicode and saved. Restarted SMTPSvc. I sent some more test messages – now I could instantly see the messages acted upon counter rising. Spam started showing up in the Junk Mail folder and Outlook started showing the SCL values, as expected.
{ 10 comments… read them below or add one }
What if the counters don’t show at all in System Monitor? I mean the IMF related counters do not appear in System Monitor?
Thanks
There are a couple of knowledge base articles regarding this. Make sure you uninstalled IMF v1 if it was loaded, then reinstall IMF2.
You , the man,its really helped me to fault find the issue .
hi, I did the changes you suggested but still cannot see the counters moving… Is there a better way to save a file as unicode other using notepad?
my server is scanning but not showing values in outlook. any thoughts?
Outlook does not display SCL values by default. Take a look at this post on Exchange team blog:
http://msexchangeteam.com/archive/2004/05/26/142607.aspx
I’m hoping you can solve my problem with the xml file, as you did with finding IMF under SP2. I’ve saved the xml file as Unicode, restarted SMTP, re-registered the Uce dll, re-saved the xml file etc etc & I’m still getting error 7514. Can it be caused by anything else?
Thanks
Here is my 7514 error
An error occurred while loading Microsoft Exchange Intelligent Message Filter. The error code is 0x80004002. Has any one ran accross this error? I uninstalled imf1 before i installed exchange sp2?
I was having the same problem as pete – xml file opened correctly in IE, dll was registered and registry had been edited where needed. Still wasnt getting any SCL ratings in perfmon. Turned out i had a blank line at the top of the xml which although IE was fine with, IMF wasn’t. Deleted the blank line and everything started working !
*Hint – use XML Notepad 2007 (free download) from Microsoft to verify your xml file instead of IE.
I have this working to a point. If I set the SCL against a word in the xml file to be lower than the SCL server threshold then all works well. As soon as I increase the SCL value in the XML file I still receive the email but the SCL is blank. Any ideas?