Sign in
 
HomeProductsLibraryLearnDownloadsSupportForums
Microsoft Forefront TechCenter >
> 
> 
content filter logging question

Answered content filter logging question

  • Thursday, May 10, 2012 11:02 AM
     
     
    Sign In to Vote
    0

    Hello,

    I have enabled spam agent logging, and content filter incident logging.

    I would like to check messages and they ratings.

    In monitoring, no incident is logged if message is "suspected spam". I have setup that suspected spam is 5-9 SCL.

    If I change suspected spam to let's say 5-8, and for 9 I select Delete or Reject, then incident is logged.

    Also, Get-FseSpamAgentLog command returns nothing (emtpy)....

    I can analyse file at c:\program files.....\FSEAgentLog\ folder, but that's really painfull

    Do I have an Issue with logging, cause I saw on the forum that GetFseSpamAgentLog command shuld return info....?

    Tonza

     

All Replies

  • Thursday, May 10, 2012 11:17 AM
     
     Proposed
    Sign In to Vote
    1

    Hi,

    in the article http://technet.microsoft.com/en-us/library/ee358890#Enablingordisablingspamagentlogging you will find the following sentence:

    "When you enable content filter incident logging, FPE writes a record to the incidents database for every spam item that is rejected or deleted by the content filter...."

    So an incident is only logged, when an email is rejected. In your case every email that has a SCL value of 9.

    Greetings

    Christian

    Christian Groebner MVP Forefront

    • Proposed As Answer by Systemspoet Friday, May 11, 2012 5:58 PM
    •  
     
  • Thursday, May 10, 2012 11:23 AM
     
     Answered
    Sign In to Vote
    0

    Hi,

    tnx for info.

    How can I then analyse spam detection?

    My idea was that in first, I would pass all messages in, and then analyse logs for false positives, and then reconfigure SCL levels to reject or delete messages.

    Now I don't see which messages are stamped with 9, which with 8 etc...

    And another thing; why in earth then I can enable filter with state "9-Tagged and accepted" if no incidents is logged for that state?

    This is why I tried get-fseSpamAgentLog, but that command does not returns any info (and it should as far as I know).

    Tonza


    • Edited by Tonza Thursday, May 10, 2012 11:32 AM typos
    • Marked As Answer by Tonza Friday, May 11, 2012 6:55 AM
    •  
     
  • Friday, May 11, 2012 6:55 AM
     
     
    Sign In to Vote
    0

    Ok,

    Today get-fseSpamAgentLogs returns data.

    Strange, but ok.

    Case closed.

    Tonza

    Tonza

     
  • Friday, May 11, 2012 10:15 AM
     
     
    Sign In to Vote
    0

    Hi,

    good to hear that it's working now. Thanks for the feedback!

    Greetings

    Christian

    Christian Groebner MVP Forefront