02-19-2013 10:00 AM
JournalTask.exe get hung at 95%-99% CPU and no longer archiving. Journal will not archive till I restart the task. After journal archived, there are few journal email sitting in the inbox. The EV server gets the following error message from the Event Viewer:
Event ID: 3263
An error occurred processing the external filter 'EnterpriseVault.CustomFilter'. No more filters will be processed.
Error: already exists. (0x80030050)
Mailbox: /O=Local/OU=EXCHANGE ADMINISTRATIVE GROUP (FYDIBOHF23SPDLT)/CN=RECIPIENTS/CN=Journal
Message Folder: ?Inbox
Message Title: Re: Computer Purchase Program
Event ID 45317
The custom filter could not process a message.
Error: already exists. (0x80030050)
Internal References:
Error [0x80030050]
{CFilter::ProcessFilter} [.\Filter.cpp, lines {259,267}, built Sep 12 21:03:51 2012]
Symantec Mail Security for Exchange quarantined the attachment and replaces it with the text.
How can I get the EV to work with Symantec Mail Security for Exchange?
Solved! Go to Solution.
02-19-2013 10:40 AM
OK then your best bet is to contact symantec support and see if EV Support and Mail security support can work together and try and determine what the issue is and how best to move forward
02-19-2013 10:16 AM
Can you get the mail security to stop scanning the journal mailbox?
Even if you could, i'm not sure that you'd want to....what i'd be interested in knowing is whether its the EV Activity that is causing the scans of the items and quarantines or whether the items being quarantined are genuinely bad items etc
But honestly, your best bet is to give symantec a call and determine what the next steps should be, hopefully EV support and mail security support can work together to resolve it
And just as a matter of interest, what are the filters that you are using for the journal?
02-19-2013 10:31 AM
We don't want to stop the scanning. Below is the example what i'm using for filter..
<?xml version="1.0"?>
<RULE_SET xmlns="x-schema:ruleset schema.xdr">
<!--Author Rule: This rule will not archive based on author criteria -->
<RULE NAME="Alert Notification author" ACTION="MOVE_DELETED_ITEMS">
<AUTHOR INCLUDES="ANY">
<EA>Alert01@ad.local</EA>
<EA>Alert02@ad.local</EA>
<EA>Alert03@ad.local</EA>
</AUTHOR>
</RULE>
<!--Subject Rule: This rule will not archive based on subject criteria -->
<RULE NAME="Alert Notification Subject" ACTION="MOVE_DELETED_ITEMS">
<SUBJECTS INCLUDES="ANY">
<SUBJ MATCH="CONTAINS">Spam Quarantine Notification</SUBJ>
<SUBJ MATCH="EXACT">Undeliverable_1</SUBJ>
</SUBJECTS>
</RULE>
<!--Example Rule 2: This rule will exclude any email from archiving if it is sent to someone in the Employee Benefits distribution list. -->
<RULE NAME="Distribution LIst" ACTION="MOVE_DELETED_ITEMS">
<AUTHOR>
<DL>Enterprise Vault Excluded</DL>
</AUTHOR>
</RULE>
</RULE_SET>
02-19-2013 10:40 AM
OK then your best bet is to contact symantec support and see if EV Support and Mail security support can work together and try and determine what the issue is and how best to move forward
02-19-2013 10:41 AM
What versions of the software(s) are we talking about, and what version of Exchange?
Is there a way to configure Symantec Mail Security for Exchange to remove the 'whole' message, for quarantine, rather than replacing for text?