FSOCS reporting and statistics

 

Applies to: Forefront Security for Office Communications Server

Microsoft Forefront Security for Office Communications Server (FSOCS) provides various mechanisms in order to help administrators analyze the state and performance of the FSOCS services through the Forefront Server Security Administrator. For more information, see FSOCS Forefront Server Security Administrator.

Incidents database

The Incidents database (Incidents.mdb) contains all virus and filter detections for an IM server, regardless of whether they were caught by the scan job or a filter. The Incidents database is configured as a system data source name (DSN), called Forefront Incidents. This database can be viewed and manipulated by using third-party tools.

To view the Incidents database

• In the Shuttle Navigator, click REPORT, and then click the Incidents icon. The Quarantine pane opens.

This is the information that FSOCS reports for each incident:

Item	Description
Time	The date and time of the incident.
State	The action taken by FSOCS.
Folder	Not applicable.
File	The name of the virus or name of the file that matched a file filter or content filter.
Incident	The type and name of the incident detected.
Sender Address	The e-mail address of the person who sent the infected or filtered message.
Recipient Addresses	The e-mail addresses of the recipients of the infected or filtered message.

VirusLog.txt

Incidents can also be written to a text file called VirusLog.txt file, located in the Microsoft FSOCS installation path. To enable this feature, in General Options, select the Enable Forefront Virus Log check box (it is disabled by default).

The following is a sample entry from the VirusLog.txt file:

Thu. Feb 28 14:12:51 2008 (3184), “Information: IM scan found virus:

Folder: Inbound

Message: Hello

File: Eicar.com

Incident: VIRUS=EICAR-STANDARD_AV_TEST_FILE

State: Cleaned"

Forefront Security for Office Communications Server incidents

The following table describes the various incidents FSOCS reports. Several of the reported incidents are controlled through settings in General Options.

Reported incident	General Options setting	Description
CorruptedCompressedFile	Delete Corrupted Compressed Files	FSOCS has deleted a corrupted compressed file.
CorruptedCompressedUuencodeFile	Delete Corrupted Uuencode Files	FSOCS has deleted a corrupted compressed Uuencode file
EncryptedCompressedFile	Delete Encrypted Compressed Files	FSOCS has deleted an encrypted compressed file.
EngineLoopingError	Not applicable	FSOCS has deleted a file causing a scan engine to be caught in a read/write loop while scanning or attempting to clean a file.
ExceedinglyInfected	Maximum Container File Infections	FSOCS has deleted a container file because it exceeded the maximum number of infections, as set in the Max Container File Infections setting in General Options.
ExceedinglyNested	Maximum Nested Compressed Files	FSOCS has deleted a container file because it exceeded the maximum nested depth, as set in the Max Nested Compressed Files setting in General Options.
ExceedinglyNested	Maximum Nested Attachments	FSOCS has deleted a file because it exceeded the maximum nested attachment limit, as set in the Max Nested Attachments setting in General Options. The default is 30 attachments. For more information, see "MaxNestedAttachments" in FSOCS registry keys.
LargeInfectedContainerFile	Maximum Container File Size	FSOCS has deleted a file because it exceeded the maximum container size that it attempts to clean or repair. The default is 26 megabytes, but you may change the value with the Max Container File Size setting in General Options.
ScanTimeExceeded	Max Container Scan Time (msec) - IM	FSOCS has deleted a container file because it exceeded the maximum scan time. The default value, in milliseconds, is 120000 msec (two minutes).
UnReadableCompressedFile	Not applicable	FSOCS has deleted a compressed file that it could not read.
UnWriteableCompressedFile	Not applicable	FSOCS has deleted a compressed file to which it cannot write (for example, during a cleaning operation).

Statistics

FSOCS tracks and maintains several kinds of statistics for messages and file transfers. These statistics are also available as performance counters. For more information about performance counters, see Performance.

These are the statistics that FSOCS keeps for instant messages:

• Instant Messages Scanned—The number of messages scanned by FSOCS since the last restart of the services.
• Instant Messages Detected—The number of messages scanned that contained a virus or matched a filter since the last restart of the services.
• Instant Messages Blocked—The number of messages blocked by FSOCS, because of a virus detection or filter match, since the last restart of the services.
• Total Instant Messages Scanned—The number of messages scanned by FSOCS since the product was installed.
• Total Instant Messages Detected—The number of messages scanned that contained a virus or matched a filter since the product was installed.
• Total Instant Messages Blocked—The number of messages blocked by FSOCS, because of a virus detection or filter match, since the product was installed.

These are the statistics that FSOCS keeps for file transfers:

• File Transfers Scanned—The number of file transfers scanned by FSOCS since the last restart of the services.
• File Transfers Detected—The number of file transfers scanned that contained a virus or matched a filter since the last restart of the services.
• File Transfers Cleaned—The number of files cleaned since the last restart of the services.
• File Transfers Removed—The number of files removed by FSOCS due to a virus detection or filter match since the last restart of the services.
• File Transfers Blocked—The number of file transfers blocked by FSOCS, because of a virus detection or filter match, since the last restart of the services.
• Total File Transfers Scanned—The number of file transfers scanned by FSOCS since the product was installed.
• Total File Transfers Detected—The number of file transfers scanned that contained a virus or matched a filter since the product was installed.
• Total File Transfers Cleaned—The number of files cleaned since the product was installed.
• Total File Transfers Removed—The number of files removed by FSOCS due to a virus detection or filter match since the product was installed.
• Total File Transfers Blocked—The number of file transfers blocked by FSOCS, because of a virus detection or filter match, since the product was installed.

In addition to these statistics, there are four additional rate counters that can only be viewed from perfmon. For more information about performance counters, see Performance. The additional counters are:

• File Transfers Scanned Rate—The average number of file transfers scanned by FSOCS within a one-second time interval.
• File Transfers Detected Rate—The average number of file transfers containing a virus or matching a file filter detected by FSOCS within a one-second time interval.
• File Transfers Cleaned Rate—The average number of file transfers cleaned by FSOCS within a one-second time interval.
• File Transfers Removed Rate—The average number of file transfers removed by FSOCS within a one-second time interval.

Managing statistics

You can reset all statistics for the IM Scan Job.

To reset all statistics for the IM Scan Job

• In the Incidents pane, in the Statistics section, click the x next to the scan job's name. When you are asked to confirm the reset, click Yes to reset all the statistics for the IM Scan Job.

You can save the report and statistics in a text format.

To save the report and the statistics in a text format

1. On the Incidents pane, click the Export button.

2. A Windows Explorer window opens. Use it to navigate to the location at which you want to save the report.

3. Enter a name for the exported report and statistics file. The default is incidents.txt.

4. Click Save.

Quarantine

FSOCS, by default, creates a copy of every detected file in its original form (that is, before a Clean, Delete, or Skip action occurs). These files are stored in an encoded format within the designated installation folder, in the Forefront Data Folder, in the Quarantine subfolder.

To view the Incidents database, in the Shuttle Navigator, click REPORT, and then click the Quarantine icon. The Quarantine pane opens.

• the actual file name of the detected attachment
• the name of the infecting virus or the file filter name
• other bookkeeping information
• The Quarantine database is configured as a system DSN with the name Forefront Quarantine. This database can be viewed and manipulated by using third-party tools.

Quarantine options

An administrator can access the Quarantine pane in order to delete or extract quarantined items.

To view the Quarantine log

• In the Shuttle Navigator, click REPORT, and then click the Quarantine icon. The Quarantine pane opens.

This is the information that FSOCS reports for each quarantined item:

Item	Description
Date	The date the file was quarantined.
File	The name of the file that was quarantined.
Incident	The type of incident that triggered the quarantine (such as virus or filter match).
Sender Address	The e-mail address of the person who sent the infected or filtered message.
Recipient Addresses	The e-mail addresses of the recipients of the infected or filtered message.

Saving quarantine database items

You can save quarantined items as separate files.

To save quarantined items as separate files

1. On the Quarantine pane, select one or more files to be saved, and then click the Save As button. If you select multiple items, each is saved as a separate file.

2. A Windows Explorer window opens. Use it to navigate to the location where you want to save the quarantined files.

3. In Windows Explorer, in the File name box, you may enter a different name for the file before saving it. By default, the original name of the file appears in the box.

4. Click Save. The item is decoded before being saved.

5. If you selected more than one file, the next one now appears in Windows Explorer. Repeat steps 2 through 4.

Delivering quarantined messages

The Deliver button on the Quarantine pane enables administrators to deliver quarantined messages to the intended recipients or any other designated recipients.

To deliver quarantined messages

1. On the Quarantine pane, select one or more files to be delivered, and then click the Deliver button.

2. In the Confirm Delivery dialog box, in the Delivery Action section, select one of the following:

   • Original Recipients—The files will be sent to the their intended recipients, and the recipients fields are disabled.
   • Above Recipients—The selected files will be delivered to the named recipients. The recipients fields are enabled, and the administrator can change them.
   • Original and Above Recipients—The selected files will be delivered to both the original recipients and any additional ones entered. The recipients fields are enabled, and the administrator can change them.

3. When you are finished editing the recipients, click OK. The selected files are sent to the specified recipients.

If a single file is selected for delivery, the original recipients populate the To field. If multiple files are selected, the recipients fields are initially empty.

When quarantined messages are delivered to the user's mailbox, the original message is included as an attachment. When the user opens the attachment, the original message launches within Microsoft Office Outlook® as a separate message.

DeliverLog.txt

When a message file is delivered from the Quarantine database, a text file named DeliverLog.txt is created and saved in the folder where FSOCS is installed. This file provides a log of messages and attachments that have been delivered from quarantine.

Forwarding quarantined files

Files that were quarantined by the virus scanner or the file filter can be forwarded.

The ExtractFiles tool

FSOCS includes a console tool, ExtractFiles, that enables you to extract all, or a subset, of the quarantined files to a specified directory.

This is the syntax of ExtractFiles:

extractfiles <path> <type>

where path is the absolute path of the folder in which to save the extracted quarantined files*, and type* is the type of quarantined files to extract. This can be the specific name of a virus, a specific extension, or all quarantined files. For example:

• Jerusalem.Standard—Extracts files that were infected with the virus named Jerusalem.Standard.
• *.doc—Extracts quarantined files having a .doc extension.
• *.*—Extracts all quarantined files.

Examples:

extractfiles C:\temp\quarantine Jerusalem.Standard

extractfiles C:\extract\ *.doc

Maintaining the databases

There are several other tasks you can perform with the Incidents or Quarantine databases. You can clear the databases, export database items, purge database items, filter database views, move the databases, and change the database compaction time.

Clearing the databases

Over time, you might find that your Incidents and Quarantine databases are becoming very large. Each database (Incidents.mdb and Quarantine.mdb) has a 2 GB limit. When a database is larger than 1.5 GB after being compacted, a notification is sent to all those having a notification role of Virus Administrators, warning that the database is nearing its limit. An administrator can then clear the database in order to ensure that future incidents and quarantined items will be saved.

The following is the subject line of the message:

Microsoft Forefront Security for Office Communications Server Database Warning

The following is the body of the message:

The Microsoft FSOCS <<database name>> database is greater than 1.5 GB (with a maximum size of 2 GB). Its current size is x GB.

If this database grows to 2 GB, updates to the <<database name>> will not occur. Please see the user guide for information about database maintenance.

If for some reason the notification cannot be sent, the failure is ignored and is noted in the program log. One attempt to send the message is made during each compaction cycle for the specific database.

Clearing the incidents database

The Incidents database can be cleared when it becomes too large.

To clear the Incidents database

1. In the Shuttle Navigator, in the REPORT section, in the Incidents pane, click Clear Log. You are asked to confirm your decision before all the items are cleared from the Incidents pane.

2. In the Shuttle Navigator, in the OPERATE section, select Run Job. Select IM Scan Job, and then click Clear Log. Once again, you are asked to confirm your decision before all the items are cleared from the job in the Incidents pane.

   You must individually clear all scan jobs in order to have all items flagged for deletion from the database.

After you have cleared the entries in both places, they no longer appear in the panes. However, they are actually deleted from the Incidents.mdb database only when it is compacted, which automatically occurs every day at 02:00 (2:00 in the morning).

You can also delete a subset of the results by selecting one or more entries (using the SHIFT and CTRL keys), and then pressing the DELETE key in order to remove them from both locations, as indicated above.

Clearing the quarantine database

The Quarantine database can be cleared when it becomes too large.

To clear the Quarantine database

• In the Shuttle Navigator, in the REPORT section, in the Quarantine pane, click Clear Log. This clears all the items from the Quarantine pane. You will be asked to confirm your decision.

  Note

  You can also delete a subset of the results by selecting one or more entries (using the SHIFT and CTRL keys), and then pressing the DELETE key to remove them from the Quarantine listing.

After you have cleared the entries, they no longer appear in the pane. However, they are actually deleted from the Quarantine.mdb database only when it is compacted, which automatically occurs every day at 02:00 (2:00 in the morning).

Exporting database items

You can save a list of all the Incidents or Quarantine database items into a text file. This is the same list of items that appears in the Incidents or the Quarantine pane of the Forefront Server Security Administrator.

To save a list of all the results from the Incidents or Quarantine databases as a text file

1. In either the Incidents or Quarantine panes, click Export.

2. In the Save dialog box, select a location for the Incidents.txt or Quarantine.txt file, and then click Save.

In addition to the Export button, the Quarantine pane has a Save As button, used to detach and decode a selected file to disk. You can select multiple items from the Quarantine list. Each is saved as a separate file. For more information about saving files, see Saving quarantine database items.

Purging database items

You can instruct FSOCS to remove items from the databases after they are a certain number of days old. If the purge function is enabled for a database, all files older than the specified number of days are flagged for removal from that database.

To purge database items after a certain number of days

1. In the Shuttle Navigator, in the REPORT section, on either the Incidents or the Quarantine pane, select the Purge check box. This causes the Days field to become available.

   Note

   Each database can have a separate purge value (or none at all).

2. In the Days field, indicate the number of days after which items will be purged. All items older than that number of days will be deleted from the database. The default is 30 days.

3. Click Save. Setting or changing the purge value takes effect only after being saved.

To suspend purging, clear the Purge check box. The value in the Days field will remain, but no purging will take place until Purge is selected again.

Filtering database views

You can filter the Incidents or Quarantine views in order to see only certain items. The filter has no effect on the database itself, just on which records are displayed.

To filter the database view

1. In the Shuttle Navigator, in the REPORT section, on either the Incidents or Quarantine pane, select the Filtering check box.

2. In the Field drop-down, select the items you want to see. Each choice in Field corresponds to one of the columns in the display. (For example, you can show only those Incidents whose State is "Purged".)

   If you select Time or Date, you get entry fields for beginning date and time, and ending date and time.

   If you select anything other than Time (on the Incidents pane) or Date (on the Quarantine pane), the Value field appears. Enter a string in the Value field. Wildcard characters can be used. They are those used by the Microsoft Jet database OLE DB driver. The following are the wildcard characters:

   • _ (underscore)—Matches any single character. (The * and ? characters, which are common wildcard characters, are literals in this instance.)
   • [ ]—Denotes a set or a range. Matches any single character within the specified set (for example, [abcdef]) or range (for example, [a-f]).
   • [!]—Denotes a negative set or range. Matches any single character not within the specified set (for example, [!abcdef]) or range (for example, [!a-f]).

3. Click Save. The only items you now see are those that match your parameters.

4. To see all the items again, remove the filter by clearing the Filtering check box, and then click Save.

Moving the databases

You can move the Quarantine and Incidents databases. However, for FSOCS to function properly, you must move both databases, as well as all related databases and support files.

To move the databases and all related files

1. Create a new folder in a new location (for example: C:\Moved Databases).

2. To set the permissions for the new folder, do the following:

   1. Right-click the new folder, and then click Properties.
   2. On the Properties dialog box, on the Security tab, add Network Service with Full Control privileges.
   3. Enable all permissions for Administrators and System.

3. Stop Office Communications Server Front-End Service (RtcSrv).

4. Copy the entire contents of the Data folder, including the subfolders, from
   the following location:
   Microsoft Forefront Security\Office Communications Server
   into the folder created in step 1. (This results in a folder called, for example, C:\Moved Databases\Data.)

5. Change the path in the DatabasePath registry key in order to point to the new Data folder location:

   For 32-bit systems:

   HKLM\Software\Microsoft\Forefront Server Security\Office Communications Server\DatabasePath

   For 64-bit systems:

   HKLM\Software\Wow6432Node\Microsoft\Forefront Server Security\Office Communications Server\DatabasePath

6. Restart the Office Communications Server Front-End Service (RtcSrv).

Changing the database compaction time

Typically, FSOCS runs daily database-management functions on the Incident.mdb and Quarantine.mdb databases. The CompactIncidentDB function and the CompactQuarantineDB function are run to delete old database records and to delete stale quarantine items.

By default, these functions are run at 02:00 local time. However, you may want to compact the databases at a different time. To run the compaction functions at a different time, you must add a registry entry.

To change the database compaction time

1. Click Start, click Run, type regedit, and then click OK.

2. In the Registry Editor, expand the following registry subkey:

   HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Forefront Server Security\Office Communications Server

3. On the Edit menu, point to New, and then click String Value.

4. Type CompactDatabaseTime, and then press ENTER.

5. Right-click CompactDatabaseTime, and then click Modify.

6. In the Value data box, type a new value, for example 21:00, and then click OK.

   Note

   Enter the time value using the 24-hour (hh:mm) format. The value should be based on the local time during which you want the compaction functions to run.

7. Exit the Registry Editor.

8. Click Start, point to Settings, and then click Control Panel.

9. Double-click Administrative Tools, and then click Services.

10. Right-click FSCController, and then click Restart.

11. Close Services and Control Panel.

Windows Event Viewer

FSOCS stores virus detections, stop codes, system information, and other general application events in the Windows application log. Use Windows Event Viewer to access the log.

Additionally, these events are stored in ProgramLog.txt located in the Data subdirectory of the following location:
<Drive>:Program Files\Microsoft Forefront Security\Office Communications Server

Performance

All FSOCS statistics can be displayed by using the Performance snap-in (Perfmon.exe) provided by Windows and usually found in Administrative Tools. The performance object is called Microsoft Forefront Server Security.

FSOCS performance counters

All of the items listed in Statistics are performance counters that can be displayed in Perfmon under the "Microsoft Forefront Server Security" category.

In addition, there are four categories of performance counters in the Microsoft Forefront Server Security performance object:

• Microsoft FSOCS Categorizer
• Microsoft FSOCS Health
• Microsoft FSOCS Scan Filter
• Microsoft FSOCS SIP Traffic

Microsoft FSOCS Categorizer statistics

Performance counter	Definition
Microsoft FSOCS Categorizer\FileTransferMessagesAccepts	The total number of file transfer ACCEPT requests processed by the RTC Proxy component.
Microsoft FSOCS Categorizer\FileTransferMessagesAcceptsPerSecond	The number of file transfer ACCEPT requests handled each second by the RTC Proxy component.
Microsoft FSOCS Categorizer\FileTransferMessagesCancels	The total number of file transfer CANCEL requests processed by the RTC Proxy component.
Microsoft FSOCS Categorizer\FileTransferMessagesCancelsPerSecond	The number of file transfer CANCEL requests handled each second by the RTC Proxy component.
Microsoft FSOCS Categorizer\FileTransferMessagesInvites	The total number of file transfer INVITE requests processed by the RTC Proxy component.
Microsoft FSOCS Categorizer\FileTransferMessagesInvitesPerSecond	The number of file transfer INVITE requests handled each second by the RTC Proxy component.
Microsoft FSOCS Categorizer\FileTransferMessagesTotal	The total number of file transfer requests processed by the RTC Proxy component.
Microsoft FSOCS Categorizer\FileTransferMessagesTotalPerSecond	The number of file transfer requests handled each second by the RTC Proxy component.
Microsoft FSOCS Categorizer\IMConversationRtfFormats	The total number of instant message conversations with a MIME type of "text/rtf" processed by the RTC Proxy component.
Microsoft FSOCS Categorizer\IMConversationRtfFormatsPerSecond	The number of instant message conversations with a MIME type of "text/rtf" processed each second by the RTC Proxy component.
Microsoft FSOCS Categorizer\IMConversationAlternativeFormats	The total number of instant message conversations with a MIME type of "multipart/alternative" processed by the RTC Proxy component.
Microsoft FSOCS Categorizer\IMConversationAlternativeFormatsPerSecond	The number of instant message conversations with a MIME type of "multipart/alternative" processed each second by the RTC Proxy component.
Microsoft FSOCS Categorizer\IMConversationTxtFormats	The total number of instant message conversations with a MIME type of "text/plain" processed by the RTC Proxy component.
Microsoft FSOCS Categorizer\IMConversationTxtFormatsPerSecond	The number of instant message conversations with a MIME type of "text/plain" processed each second by the RTC Proxy component.
Microsoft FSOCS Categorizer\IMConversationTotal	The total number of instant message conversations processed by the RTC Proxy component.
Microsoft FSOCS Categorizer\IMConversationTotalPerSecond	The number of instant message conversations handled each second by the RTC Proxy component.
Microsoft FSOCS Categorizer\IMConversationUnsupportedContentTypes	The total number of instant message conversations with an unsupported MIME type processed by the RTC Proxy component.
Microsoft FSOCS Categorizer\IMConversationUnsupportedContentTypesPerSecond	The number of instant message conversations with an unsupported MIME type processed each second by the RTC Proxy component.
Microsoft FSOCS Categorizer\RequestsReceivedInvites	The total number of INVITE SIP message requests processed by the RTC Proxy component.
Microsoft FSOCS Categorizer\RequestsReceivedInvitesPerSecond	The number of INVITE SIP message requests handled each second by the RTC Proxy component.
Microsoft FSOCS Categorizer\RequestsReceivedMessages	The total number of MESSAGE SIP message requests handled by the RTC Proxy component.
Microsoft FSOCS Categorizer\RequestsReceivedMessagesPerSecond	The number of MESSAGE SIP message requests handled each second by the RTC Proxy component.
Microsoft FSOCS Categorizer\RequestsReceivedTotal	The total number of SIP message requests processed by the RTC Proxy component.
Microsoft FSOCS Categorizer\RequestsReceivedTotalPerSecond	The number of SIP message requests handled each second by the RTC Proxy component.

Microsoft FSOCS Health

Performance counter	Definition
Microsoft FSOCS Health\\ActiveSIPMessageObjects	The number of message objects in use by the RTC Proxy.
Microsoft FSOCS Health\\ActiveWorkerThreads	The number of worker threads currently active in the agent.
Microsoft FSOCS Health\\ManagedMemoryUse	The amount of memory used by the .NET runtime.
Microsoft FSOCS Health\\QueuedFileTransfersToScan	The number of file transfer messages in the queue waiting to be scanned.
Microsoft FSOCS Health\\QueuedIMConversationsToScan	The number of IM conversations in the queue waiting to be scanned.
Microsoft FSOCS Health\\ScanDeferredSIPMessages	The number of IM messages that were not scanned because of the depth of the server agent queue.
Microsoft FSOCS Health\\ThrottleModeEvents	The number of events triggered for low CLR memory conditions.
Microsoft FSOCS Health\\TimeoutsHandled	The number of messages that timed out and were handled by the RTC Proxy.
Microsoft FSOCS Health\\TransactionsCanceledHandled	The number of requests and response transactions that were canceled before completion.

Microsoft FSOCS Scan Filter

Performance counter	Definition
Microsoft FSOCS Scan Filter\AverageProcessingTimeFileTransfer	The average length of time it takes to scan a file transfer.
Microsoft FSOCS Scan Filter\AverageProcessingTimeIMConversation	The average length of time it takes to scan an IM conversation message.
Microsoft FSOCS Scan Filter\AverageSizeScanPayloadFileTransfer	The average size of a scanned file.
Microsoft FSOCS Scan Filter\AverageSizeScanPayloadIMConversation	The average size of a scanned IM conversation message.
Microsoft FSOCS Scan Filter\FileTransfersBlocked	The number of times a file transfer was prevented.
Microsoft FSOCS Scan Filter\IMConversationsBlocked	The number of times an IM conversation was prevented from being delivered.
Microsoft FSOCS Scan Filter\NotificationsSent	The number of IM messages sent that were notifications.
Microsoft FSOCS Scan Filter\SIPTransfersRejected	The number of times a SIP message was rejected.

Microsoft FSOCS SIP Traffic

Performance counter	Definition
Microsoft FSOCS SIP Traffic\LocallyGenerated182	The number of SIP messages waiting to be processed by the RTC Proxy.
Microsoft FSOCS SIP Traffic\LocallyGenerated400	The number of invalid SIP requests received by the server.
Microsoft FSOCS SIP Traffic\LocallyGenerated406	The number of SIP requests rejected by the server due to unacceptable content.
Microsoft FSOCS SIP Traffic\LocallyGenerated415	The number of messages rejected by the RTC Proxy because of unknown or unsupported content types.
Microsoft FSOCS SIP Traffic\LocallyGenerated503	The number of incoming SIP requests that were rejected because the server was overloaded with messages.
Microsoft FSOCS SIP Traffic\ProxyRequestsFailed	The number of SIP messages that the RTC Proxy failed to forward to the server.
Microsoft FSOCS SIP Traffic\ProxyRequestsSucceeded	The number of SIP messages that were successfully forwarded from the RTC Proxy to the server.