Archived files go to "Failed External Filter" folder.

[jmor2440]

I recently enabled a user's account for archiving, but whenever she tries to manually archive, the clock appears over the message and then the message goes into "Failed External Filter".  I checked the security logs on the EV server and it shows the user successfully logging in/out.  Just the one user.

Also, whenever the user tries to archive the following error pops up in the event viewer on the EV server: error 3263: "An error occurred processing the external filter 'EnterpriseVault.CustomFilter'.  No more filters will be processed." 

[TonySterling]

Could you share some more details about your environment?

What version of EV?

What version of Outlook?

Do other users have the same problem?

What exactly does your custom filter do?

[jmor2440]

Sure, thanks for taking the time to help.

EV 9.0.2

Outlook 2007

One user had the same problem a couple months ago and her archiving just started working on it's own a couple days later.  The only connection between these two users is that they both use workstations (90% of our users connect through Citrix)

[TonySterling]

Thanks for that, can you post your custom filter rules?

[jmor2440]

Wouldn't that be under "C:\program files\enterprise vault" on the EV server?

[TonySterling]

It will be under *\Enterprise Vault\Custom Filter Rules folder.

[jmor2440]

That's what I thought, there is no custom filter rules folder, just *\enterprise vault\deployment scanner.

All of the other users' are able to archive fine though.

[TonySterling]

If all you have is Deployment Scanner that isn't your installation directory.

Is your server 64 bit?  If yes you need to look under \Program Files (x86)\ directory? You can also verify the install path from the registry.

[jmor2440]

Sorry, it was on the E:.... 

There are 3 different files, which one do you need? (customproperties.xsd, default filter rules.xml, ruleset schema.xdr)

Also, would you like copy/paste or upload?

[TonySterling]

No worries!  :)

Default Filter Rules, you can save it as a txt file and attach it. 

[jmor2440]

Not sure, there isn't much in here.

[Rob_Wilcox1]

I have the same problem in EV 9.0.3.

If you do a run-now against the mailbox it will work - I mean the rules will work - but if you do a manual archive, with ANY rule, then you get failures..

13408 08:22:16.277  [1044] (ArchiveTask) <948> EV:M CEVFilterController::ProcessAllFilters - Processing External Filter [EnterpriseVault.CustomFilter] - MailboxDN:[/o=First Organization/ou=Exchange Administrative Group (FYDIBOHF23SPDLT)/cn=Recipients/cn=Adele.Reinhardt] Folder:[ Inbox] Title:[test123]|

13409 08:22:16.277  [1044] (ArchiveTask) <948> EV:L {CEVFilterController::get_MAPIMessage()} (Entry)

13410 08:22:16.292  [1044] (ArchiveTask) <948> EV:M IsEnvelopeMessage - GetIDsFromNames returned 0x00000000

13411 08:22:16.292  [1044] (ArchiveTask) <948> EV:M IsEnvelopeMessage - Exiting Routine [IsEnvelope=False] [IsExchange2007=False] [0x80070057]

13412 08:22:16.292  [1044] (ArchiveTask) <948> EV:H {IsEnvelopeMessage} HRXEX fn trace : Returning error [0x80070057], [..\AgentsCommon\EnvelopeJournal.cpp, lines {436,545}, built Nov 11 21:02:46 2011].

13413 08:22:16.292  [1044] (ArchiveTask) <948> EV:M CEVFilterController::InitializeMAPIMessages - Call to IsEnvelopeMessage failed [0x80070057]

13414 08:22:16.292  [1044] (ArchiveTask) <948> EV:H {CEVFilterController::get_MAPIMessage()} (Exit) Status: [The parameter is incorrect.  (0x80070057)]

13415 08:22:16.292  [1044] (ArchiveTask) <948> EV:H {CFilter::ProcessFilter} HRXEX fn trace : Error [0x80070057], [.\Filter.cpp, lines {294,302}, built Nov 11 21:02:47 2011].

13416 08:22:16.292  [1044] (ArchiveTask) <948> EV~E Event ID: 45317 The custom filter could not process a message. |Error: The parameter is incorrect.  (0x80070057) |Internal References:  |Error [0x80070057] |{CFilter::ProcessFilter} [.\Filter.cpp, lines {294,302}, built Nov 11 21:02:47 2011] |

13417 08:22:16.292  [1044] (ArchiveTask) <948> EV:M CEVFilterController::ProcessAllFilters - Time Taken to Process External Filter [EnterpriseVault.CustomFilter]: [0.003950] seconds

Why is the task checking for Envelope Messages (ie journaling)?  I don't know.

I'd suggest speaking with Symantec Support ...

Another oddity I have seen is that the rule sometimes works fine, in that it doesn't cause an error, but when manually archiving an item, it will archive it (even where your rule says 'subject contains interscan = delete)..  but it works PROPERLY when you do a run-now on the mailbox.

[jmor2440]

Ok, I will talk with support.  Thanks for your help and I will update this when I get an answer.

[jmor2440]

No need to talk with support.  It seems that after the weekend backups and archiving ran, everything is working fine.  Not sure exactly what happened to fix it, but I will look into it.  Also, I was thinking that maybe b/c I did a local move for the user on Exchange server right before I enabled the account for archiving on the EV server, that may have been an issue... that they were so close together.  Any thoughts before I close this thread?

[TonySterling · Accepted solution]

That is a bit strange, I wonder if a couple of synchronizations just needed to take place.  Are you running Cached mode for Outlook?  It could be a delay in synching the hidden message on Exchange to local cache??