Monitoring and Troubleshooting Exchange Server Intelligent Message Filter

Monitoring and Troubleshooting Exch...

Collapse All

Topic Last Modified: 2007-01-22

You can monitor and troubleshoot issues with Microsoft® Exchange Intelligent Message Filter using Event Viewer and System Monitor.

How to Use Event Viewer

In Event Viewer, both the Application log and the System log contain errors, warnings, and informational events that relate to the operation of Exchange Server, the Simple Mail Transfer Protocol (SMTP) service, and other applications. To help you determine the cause of Intelligent Message Filter problems, carefully review the data in the Application log and System log. Intelligent Message Filter writes events to Event Viewer using the source MSExchangeTransport and the category, SMTP Protocol.

To view errors, warnings, and informational events in the Application log

Click Start, point to All Programs, point to Administrative Tools, and then click Event Viewer.
In the console tree, click Application Log.
To sort the log alphabetically and quickly locate an entry for an Exchange service, in the details pane, click Source.
To filter the log to list entries for events logged for Intelligent Message Filter, on the View menu, click Filter.
In Application Log Properties, use the Event source list to select MSExchangeTransport.
In the Category list, select SMTP Protocol.

The following table explains the events that are logged by Intelligent Message Filter. Unless otherwise noted, all events are logged at the default logging level.

Event	Explanation
Event ID: 7512 Severity=Informational Text: The message with ID <message id>, P1 From <sender name>, Subject <subject> from remote host <host name> was Rejected/Deleted by the Intelligent Message Filter.	Intelligent Message Filter writes this event when it rejects or deletes a message at the gateway. This event is recorded only when the logging level is set to medium or maximum for the SMTP Protocol category of the MSExchangeTransport service. To set the logging level, use the Diagnostic Logging tab of the Exchange server properties.
Event ID: 7513 Severity=Informational Text: Microsoft Exchange Intelligent Message Filter was refreshed for code version <version number>, data version <version number>. Microsoft Exchange Intelligent Message Filter is now enabled. A refresh occurs when the SMTP service is restarted or Microsoft Exchange Intelligent Message Filter is updated.	Intelligent Message Filter writes this event when Intelligent Message Filter is enabled for the first time or when Intelligent Message Filter is updated. This event log is also written when the SMTP service is restarted.
Event ID: 7514 Severity=Error Text: An error occurred while loading Microsoft Exchange Intelligent Message Filter. The error code is <error code>.	Intelligent Message Filter writes this event when an error occurs when enabling or updating Intelligent Message Filter. Uninstall the new version of Intelligent Message Filter (newly installed Intelligent Message Filter Update package) and try to reinstall.
Event ID: 7515 Severity=Error Text: An error occurred while Microsoft Intelligent Message Filter tried to filter a message with ID <message ID>, P1 From <sender>, Subject <subject>. This message will not be filtered. The error code is <error code>.	Intelligent Message Filter writes this event when it cannot filter a message. Possible causes are corrupted or malformed messages.

Event

Explanation

Event ID: 7512

Severity=Informational

Text:

The message with ID <message id>, P1 From <sender name>, Subject <subject> from remote host <host name> was Rejected/Deleted by the Intelligent Message Filter.

Intelligent Message Filter writes this event when it rejects or deletes a message at the gateway.

This event is recorded only when the logging level is set to medium or maximum for the SMTP Protocol category of the MSExchangeTransport service. To set the logging level, use the Diagnostic Logging tab of the Exchange server properties.

Event ID: 7513

Severity=Informational

Text:

Microsoft Exchange Intelligent Message Filter was refreshed for code version <version number>, data version <version number>. Microsoft Exchange Intelligent Message Filter is now enabled. A refresh occurs when the SMTP service is restarted or Microsoft Exchange Intelligent Message Filter is updated.

Intelligent Message Filter writes this event when Intelligent Message Filter is enabled for the first time or when Intelligent Message Filter is updated. This event log is also written when the SMTP service is restarted.

Event ID: 7514

Severity=Error

Text:

An error occurred while loading Microsoft Exchange Intelligent Message Filter.

The error code is <error code>.

Intelligent Message Filter writes this event when an error occurs when enabling or updating Intelligent Message Filter.

Uninstall the new version of Intelligent Message Filter (newly installed Intelligent Message Filter Update package) and try to reinstall.

Event ID: 7515

Severity=Error

Text:

An error occurred while Microsoft Intelligent Message Filter tried to filter a message with ID <message ID>, P1 From <sender>, Subject <subject>. This message will not be filtered.

The error code is <error code>.

Intelligent Message Filter writes this event when it cannot filter a message. Possible causes are corrupted or malformed messages.

How to Use System Monitor and Performance Logs and Alerts

Intelligent Message Filter has several performance counters that you can use to monitor performance and operation.

To monitor Intelligent Message Filter using System Monitor

Click Start, point to All Programs, point to Administrative Tools, and then click Performance.
Right-click System Monitor, and then click Add Counters.
In Add Counters, under Performance Object, select MSExchange Intelligent Message Filter.

Counter	Description
Total Messages Scanned for UCE	The total number of messages scanned by Intelligent Message Filter. If this number is 0 or very low, Intelligent Message Filter might not be functioning correctly.
Messages Scanned for UCE/sec	The number of messages scanned per second by Intelligent Message Filter. This counter indicates how quickly Intelligent Message Filter is operating.
Total UCE Messages Acted Upon	The total number of messages that Intelligent Message Filter has identified as UCE and acted on based on the action specified by an administrator.
UCE Messages Acted Upon/sec	The number of messages acted on per second by Intelligent Message Filter. This counter indicates how quickly Intelligent Message Filter takes action on items that are identified as UCE.
% UCE out of Total Messages Scanned	The percentage of the total number of messages scanned by Intelligent Message Filter that were identified as UCE.
% UCE of Messages Scanned in the previous 30 minutes	The percentage of the number of messages scanned by Intelligent Message Filter in the previous 30 minutes that were identified as UCE.
Total Messages Assigned an SCL Rating of X	The total number of messages scanned by Intelligent Message Filter that were assigned a spam confidence level (SCL) rating of x, where x is a spam rating of 0 to 9.

Uninstalling Version 1 of Intelligent Message Filter

You must uninstall Intelligent Message Filter v1, which was an add-in, before you can install Exchange Server 2003 Service Pack 2 (SP2) which includes Intelligent Message Filter v2. Typically, you use the Add or Remove Programs option from Control Panel to perform an uninstall. (Click Start, click Control Panel, and then click Add or Remove Programs.) However, in some cases, Intelligent Message Filter v1 does not appear in the list of programs, or the SP2 installation is blocked after you do find and uninstall v1. Possible reasons for this are as follows.

When Intelligent Message Filter v1 does not appear in the Add or Remove Programs list, a likely reason is that you are trying to uninstall it from a different account than what was used to originally install it. If, for example, Intelligent Message Filter v1 was installed with Administrator permissions, but you are trying to use an Administrator-equivalent account to install Exchange Server 2003 SP2, the SP2 installer will fail and Intelligent Message Filter will not be listed in Add or Remove Programs. In this case, log on with the account that was used to install Intelligent Message Filter v1, and then uninstall.

If the Intelligent Message Filter v1 is listed in Add or Remove Programs but the SP2 installation is still being blocked, try to first uninstall Intelligent Message Filter, install it again, restart, and uninstall. Usually, this should clean up the Intelligent Message Filter enough for SP2 to install cleanly.

If you still cannot uninstall v1, manually remove the Intelligent Message Filter from the server following these steps.

Caution:
Incorrectly editing the registry can cause serious problems that may require that you reinstall the operating system. Problems that results from editing the registry incorrectly may be unable to be resolved. Before editing the registry, back up any valuable data.

To manually remove Intelligent Message Filter v1

Stop all Exchange services (Information Store, System Attendant, SMTP, and Exchange-aware antivirus services).
Rename the MSCFV1 folder in X:\Program Files\Exchsrvr\bin, where X is the drive letter where Exchange Server is installed.
Rename the ContentFilter.dll file in X:\Program Files\Exchsrvr\bin\, where X is the drive letter where Exchange Server is installed.
Open regedit and export the HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Exchange key.
Delete the ContentFilterVersion sub key from the registry.
Restart the server. You should now be able to install Exchange Server 2003 SP2 without errors.