locked
Content Filter / Transport Rule Issue RRS feed

  • Question

  • I am running 2007 with an Edge server. i have configured the transport
    rule to take certain words and give them SCL of 9. I have a quarantine
    mailbox that i have made to direct these emails to.  I also have these
    same words in the content filter set to quarantine emails with an SCL
    rating over 8.
    When i use one of the keywords to send an email from outside, the mail
    does not go into the quarantine box as it should.  I don't get a
    bounce or anything. It just goes into space.
    i have read that i need to flip the order of the content filter and
    the transport rule to make the content filter run before the transport
    rule.  however this does not make sense to me as i tell the transport
    rule to make these keyword a 9 and to quarantine it to a certain email
    address.

    Any thoughts on what is happening here?
    Jenn

    Tuesday, June 2, 2009 9:03 PM

Answers

  • i have found the issue.  I had the email address in both the content filter and rule. i removed it from the rule and left in content filter. it started working fine.
    Thank you for your help.
    Jenn
    • Marked as answer by JJCarr Thursday, June 4, 2009 9:01 PM
    Thursday, June 4, 2009 9:01 PM

All replies

  • Hi,

    I think that your SCLRejectTreshold or your SCLDeleteTreshold is lower than 9 what you set on message. Please configure your treshold values accordingly.
    To check your actual status run this command:
    Get-ContentFilterConfig

    To configure your values refer to this article:
    http://technet.microsoft.com/en-us/library/aa995995.aspx

    Regards,
    Zoltán
    http://www.clamagent.org - Free Antivirus for Exchange
    http://www.it-pro.hu
    http://emaildetektiv.hu
    Tuesday, June 2, 2009 9:16 PM
  • Check info:

    1.      Is this Edge server the internet-facing server?

    2.      Quote: “I also have these same words in the content filter”

    You have set the words in the “Custom Words” lab, right?

    3.      Quote: “It just goes into space”

    Do you mean that the message disappeared or went to recipient’s mailbox?

    4.      Please check the SCL related setting:

    ·         Get-ContentFilterConfig (Globally)

    ·         Get-Mailbox | Fl SCL*(Check the SCL setting on the test recipient, make sure that all parameters related to SCL is empty)

    5.      Please use Get-MessageTrackingLog to track those test messages

    6.      Also, we can enable the pipeline tracing and send the test mails again. pipeline tracing will log all actions that each transport rule takes on the messages

    Notes: Please disable pipeline tracing after the testing

    How to Enable Pipeline Tracing

    Using Pipeline Tracing to Diagnose Transport Agent Problems

    Wednesday, June 3, 2009 11:03 AM
  • Forgive me as I am still new at this.....

    I have lowered the value for the SCL in the transport rule to 8.
    Content Filter- i have set it to quarantine messages with value of 8 or greater.
    for the delete and reject they both say 9 but i do not have the boxes checked.  i want all going into quarantine for now.
    Thanks
    Jenn
    Wednesday, June 3, 2009 1:56 PM
  • 1- edge is internet facing
    2- I have the same set of word listed in the custom words on the content filter and in the transport rule itself
    3- the msg just disappears.
    4- content filter- delete and reject boxes are not checked on actions tab but are set to 9
        quarantine is checked and i lowered it to 8
        transport rule- i lowered it to stamp each word as it comes thru as an 8 (I lowered this from 9)
        get-mailbox- i have tried using this command on the transport server. It does not recognize the command. Do i need to run that on the exchange server itself?
    5- when i do the tracking log- how do i set it up just to track specific emails?

    Thank you for all your help.
    Jenn
    Wednesday, June 3, 2009 3:22 PM
  • Please run “Get-Mailbox” on mailbox server role

    Here’s an example for Get-MessageTrackingLog:

    Get-MessageTrackingLog -Start "06/03/2009 9:00AM" -End "06/05/2009 5:00PM" -Sender "jamesluo@sg.com" | fl

    Thursday, June 4, 2009 1:23 AM
  • i have found the issue.  I had the email address in both the content filter and rule. i removed it from the rule and left in content filter. it started working fine.
    Thank you for your help.
    Jenn
    • Marked as answer by JJCarr Thursday, June 4, 2009 9:01 PM
    Thursday, June 4, 2009 9:01 PM