cancel
Showing results for 
Search instead for 
Did you mean: 

Journaltask.exe high CPU and Symantec Mail Security for Exchange

jdewing
Level 4

JournalTask.exe get hung at 95%-99% CPU and no longer archiving.  Journal will not archive till I restart the task.  After journal archived, there are few journal email sitting in the inbox.  The EV server gets the following error message from the Event Viewer:

                Event ID: 3263

An error occurred processing the external filter 'EnterpriseVault.CustomFilter'.  No more filters will be processed.

Error:  already exists.  (0x80030050)

Mailbox: /O=Local/OU=EXCHANGE ADMINISTRATIVE GROUP (FYDIBOHF23SPDLT)/CN=RECIPIENTS/CN=Journal

Message Folder: ?Inbox

Message Title: Re: Computer Purchase Program

 

Event ID 45317

The custom filter could not process a message.

Error:  already exists.  (0x80030050)

Internal References: 

Error [0x80030050]

{CFilter::ProcessFilter} [.\Filter.cpp, lines {259,267}, built Sep 12 21:03:51 2012]

 

Symantec Mail Security for Exchange quarantined the attachment and replaces it with the text.

 

How can I get the EV to work with Symantec Mail Security for Exchange?

 

1 ACCEPTED SOLUTION

Accepted Solutions

JesusWept3
Level 6
Partner Accredited Certified

OK then your best bet is to contact symantec support and see if EV Support and Mail security support can work together and try and determine what the issue is and how best to move forward

https://www.linkedin.com/in/alex-allen-turl-07370146

View solution in original post

4 REPLIES 4

JesusWept3
Level 6
Partner Accredited Certified

Can you get the mail security to stop scanning the journal mailbox?
Even if you could, i'm not sure that you'd want to....what i'd be interested in knowing is whether its the EV Activity that is causing the scans of the items and quarantines or whether the items being quarantined are genuinely bad items etc

But honestly, your best bet is to give symantec a call and determine what the next steps should be, hopefully EV support and mail security support can work together to resolve it

And just as a matter of interest, what are the filters that you are using for the journal?

https://www.linkedin.com/in/alex-allen-turl-07370146

jdewing
Level 4

We don't want to stop the scanning.  Below is the example what i'm using for filter..

<?xml version="1.0"?>
<RULE_SET xmlns="x-schema:ruleset schema.xdr">

<!--Author Rule: This rule will not archive based on author criteria -->
    
     <RULE NAME="Alert Notification author" ACTION="MOVE_DELETED_ITEMS">
        <AUTHOR INCLUDES="ANY">
            <EA>Alert01@ad.local</EA>
            <EA>Alert02@ad.local</EA>
            <EA>Alert03@ad.local</EA>     
        </AUTHOR>
    </RULE>


<!--Subject Rule: This rule will not archive based on subject criteria -->

    <RULE NAME="Alert Notification Subject" ACTION="MOVE_DELETED_ITEMS">
        <SUBJECTS INCLUDES="ANY">
            <SUBJ MATCH="CONTAINS">Spam Quarantine Notification</SUBJ>
            <SUBJ MATCH="EXACT">Undeliverable_1</SUBJ>
        </SUBJECTS>
    </RULE>

<!--Example Rule 2: This rule will exclude any email from archiving if it is sent to someone in the Employee Benefits distribution list. -->

    <RULE NAME="Distribution LIst" ACTION="MOVE_DELETED_ITEMS">
        <AUTHOR>
            <DL>Enterprise Vault Excluded</DL>
        </AUTHOR>
    </RULE>
</RULE_SET>

JesusWept3
Level 6
Partner Accredited Certified

OK then your best bet is to contact symantec support and see if EV Support and Mail security support can work together and try and determine what the issue is and how best to move forward

https://www.linkedin.com/in/alex-allen-turl-07370146

Rob_Wilcox1
Level 6
Partner

What versions of the software(s) are we talking about, and what version of Exchange?

Is there a way to configure Symantec Mail Security for Exchange to remove the 'whole' message, for quarantine, rather than replacing for text? 

Working for cloudficient.com