Troubleshooting IMF: Important performance counter

by Bharat Suneja

Earlier today I saw some strange behavior with Intelligent Message Filter (IMF) v2. Incoming internet mail wasn’t getting scanned by IMF. Outlook did not show the SCL values for any message!

That in itself wasn’t the strange part. I’m positive I have the right gateway and store thresholds, and I have IMF enabled on the SMTP Virtual Server – I double-checked that as soon as I saw the issue.

Next stop – check IMF performance counters. A word about monitoring SMTP (and IMF in particular) with Perfmon— the default view is a graph, and if you’re dealing with a server that doesn’t get much traffic (the server in question being my primary Exchange server on the home network – it doesn’t get hundreds of messages on a Sunday night), switching to the Report view and looking at the numbers makes it much easier to detect any activity. This could potentially save a lot of time, as it often does for me.

I quickly added the following counters of MSExchange Intelligent Message Filter object:

  • 1. Total Messages Scanned for UCE
  • 2. Messages Scanned for UCE/sec
  • 3. %UCE of Total Messages Scanned
  • 4. %UCE of Messages Scanned in the previous 30 minutes

Also added the following from SMTP Server object:

  • 1. Messages Received Total
  • 2. Messages Received/sec

With the Report view fired up, I started sending messages – some with all the characteristics of UCE, and some simple test messages. Here’s where the strange behavior comes in – the SMTP Messages Received counters were rising, and surprisingly so were Total Messages Scanned for UCE. However, Outlook still didn’t show any SCL values and all the obvious spam was still hitting my Inbox!

Here’s where another important IMF counter comes in – Total UCE Messages Acted Upon (and its siblingUCE Messages Acted Upon/sec). Once these were added to the Perfmon console, I spent a few minutes sending some more messages. The UCE Messages Acted Upon counters did not move at all, whereas Total Messages Scanned was inching higher.

IMF was scanning, but not acting on those messages!

Next stop (and don’t ask me why this wasn’t the first thing I checked :)Event Logs. The familiar Event ID 7514 that I was trying to reproduce for another test earlier in the day showed up in the Application Event Log! This is an error logged by MSExchangeTransport. Description: An error occurred while loading Microsoft Exchange Intelligent Message Filter. The error code is 0x80004005.

The error was caused by saving the MSExchange.UceContentFilter.xml file as text. This file is used by the new Custom Weighting feature introduced with IMF v2 in SP2. The file needs to be saved with encoding set to Unicode.

Screenshot: Saving MSExchange.UceContentFilter.xml file in Unicode format
Figure 1: The Custom Weighting file MSExchangeUceContentFilter.xml should be saved in Unicode format

Opened file in notepad, changed to Unicode and saved. Restarted SMTPSvc. I sent some more test messages – now I could instantly see the messages acted upon counter rising. Spam started showing up in the Junk Mail folder and Outlook started showing the SCL values, as expected.

{ 10 comments… read them below or add one }

Sarbjit Singh Gill March 14, 2006 at 5:25 am

What if the counters don’t show at all in System Monitor? I mean the IMF related counters do not appear in System Monitor?

Thanks

Reply

Kurt July 11, 2006 at 11:22 am

There are a couple of knowledge base articles regarding this. Make sure you uninstalled IMF v1 if it was loaded, then reinstall IMF2.

Reply

Anonymous August 24, 2006 at 1:06 pm

You , the man,its really helped me to fault find the issue .

Reply

Anonymous October 24, 2006 at 10:48 am

hi, I did the changes you suggested but still cannot see the counters moving… Is there a better way to save a file as unicode other using notepad?

Reply

Anonymous November 18, 2006 at 1:58 am

my server is scanning but not showing values in outlook. any thoughts?

Reply

Bharat Suneja November 23, 2006 at 9:31 am

Outlook does not display SCL values by default. Take a look at this post on Exchange team blog:
http://msexchangeteam.com/archive/2004/05/26/142607.aspx

Reply

Pete February 5, 2007 at 10:33 am

I’m hoping you can solve my problem with the xml file, as you did with finding IMF under SP2. I’ve saved the xml file as Unicode, restarted SMTP, re-registered the Uce dll, re-saved the xml file etc etc & I’m still getting error 7514. Can it be caused by anything else?
Thanks

Reply

Anonymous July 14, 2007 at 1:35 pm

Here is my 7514 error
An error occurred while loading Microsoft Exchange Intelligent Message Filter. The error code is 0x80004002. Has any one ran accross this error? I uninstalled imf1 before i installed exchange sp2?

Reply

Steve October 8, 2007 at 8:45 pm

I was having the same problem as pete – xml file opened correctly in IE, dll was registered and registry had been edited where needed. Still wasnt getting any SCL ratings in perfmon. Turned out i had a blank line at the top of the xml which although IE was fine with, IMF wasn’t. Deleted the blank line and everything started working !

*Hint – use XML Notepad 2007 (free download) from Microsoft to verify your xml file instead of IE.

Reply

Anonymous October 17, 2007 at 8:15 am

I have this working to a point. If I set the SCL against a word in the xml file to be lower than the SCL server threshold then all works well. As soon as I increase the SCL value in the XML file I still receive the email but the SCL is blank. Any ideas?

Reply

Leave a Comment

Previous post:

Next post: