In general, any message accepted via SMTP (or via drop/pickup folders) is a non-promoted message until it is processed by the store. This means that it gets stored into the STM file in an Exchange 2003 database (this is an optimization for IMAP and POP3, but not for Outlook clients). There is no STM file in Exchange 2007, so all messages are automagically promoted to the MAPI property store.
Every common header in a message stored in the database is assigned a property ID. Every X-* header is assigned a custom property ID. In general, even over millions of messages, there are only a few hundred X-* headers. What we are seeing more and more commonly, especially with message archiving and certain anti-spam solutions, is that they add a metric buttload of custom X-* headers. For example, X-00001, X-00002, . X-99999, etc. etc. Not the values of the headers, but custom headers themselves (the parts before the colon in the textual representation of the message). Now, when you move a mailbox to another store, all the messages in that mailbox lose their custom properties (why, I dunno - that seems like a bug to me). That's the standard workaround. Once you've moved all the mailboxes out of the store with too many properties, you delete the store. MFCMAPI can show you all the named properties on a store. Regards, Michael B. Smith MCSE/Exchange MVP http://TheEssentialExchange.com From: Alex Alborzfard [mailto:[EMAIL PROTECTED] Sent: Tuesday, January 22, 2008 12:35 PM To: MS-Exchange Admin Issues Subject: Re: Event ID 9667 Here are the named properties it's trying to create: X-TM-IMSS-Message-ID X-Content-Filtered-By X-Original-Date X-TFF-CGPSA-Filter X-TFF-CGPSA-Version X-Puresend X-Fantasy-No-Post X-filenames By "it" do you mean EXCH or the spam appliance? According to the event log, the user attempting to create the named property is "SYSTEM". The mailbox is actually a folder under Public Folders. So you're saying the properties are not needed and by moving the mailbox to another store, they'll get removed? On Jan 22, 2008 11:59 AM, Michael B. Smith < <mailto:[EMAIL PROTECTED]> [EMAIL PROTECTED]> wrote: This almost certainly means that it is creating a custom X-* header. It shouldn't do that. To eliminate the properties, you can move a mailbox that contains the properties to another store. Regards, Michael B. Smith MCSE/Exchange MVP http://TheEssentialExchange.com From: Alex Alborzfard [mailto:[EMAIL PROTECTED] Sent: Tuesday, January 22, 2008 10:33 AM To: MS-Exchange Admin Issues Subject: Re: Event ID 9667 If you're referring to the number after quota limit, it's 8192. There are like 6 or 7 of these events with unique named properties in the APP log. >From the named properties, it seems that it has something to do with our spam appliance. Thanks On Jan 22, 2008 9:38 AM, Michael B. Smith <[EMAIL PROTECTED]> wrote: What's the number? You only get that warning when you are within 20% of the maximum limit. You need to figure out what's creating the named properties. Regards, Michael B. Smith MCSE/Exchange MVP http://TheEssentialExchange.com From: Alex Alborzfard [mailto:[EMAIL PROTECTED] Sent: Tuesday, January 22, 2008 9:33 AM To: MS-Exchange Admin Issues Subject: Event ID 9667 I'm getting this logged in Application log of one of our EX2K3 servers. I found a Technet article (http://technet.microsoft.com/en-us/library/bb851495.aspx ) that tells you to look for some registry values, which I cannot find. How can I fix this or it's not serious and I should just leave it alone? TIA ~ Ninja Email Security with Cloudmark Spam Engine Gets Image Spam ~ ~ http://www.sunbeltsoftware.com/Ninja ~