2007 SP1 will fire events when named properties are created. I think the only option is moving mailboxes to another store as you have stated.
Something like: Event Type: Information Event Source: MSExchangeIS Event Category: General Event ID: 9873 Date: 1/22/2008 Time: 1:10:35 PM User: N/A Computer: Description: A named property has been created for the database "/o=Blackstone/ou=Exchange Administrative Group (FYDIBOHF23SPDLT)/cn=Configuration/cn=Servers/cn=Ely/cn=Microsoft Private MDB". ID: 0x9123 Named property GUID: 00020386-0000-0000-c000-000000000046 Named property name/ID: x-coolheader-sitenum The following user is attempting to create the named property: "N/A" Protocol: MAPI Client type: Transport Client version: 2049.0.33008.5 For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp. From: Michael B. Smith [mailto:[EMAIL PROTECTED] Sent: Tuesday, January 22, 2008 1:29 PM To: MS-Exchange Admin Issues Subject: RE: Event ID 9667 Sorry, I got carried away with the explanation and didn't answer the questions... I would guess that the spam appliance is creating the custom properties, but I don't know that for certain. Using MFCMAPI to examine the properties is likely a good way to identify that. Most Exchange Services run as LocalSystem, so that is why you see SYSTEM creating the properties. Custom properties are a store attribute. As far as I know (I could ping someone at MSFT, but I don't know how long it would take to get a response on this), there is no documented way to remove custom properties from a store. I've always moved the content and deleted the store. With a PF, you'd have to replicate it to another server instead of using Move Mailbox. Regards, Michael B. Smith MCSE/Exchange MVP http://TheEssentialExchange.com From: Michael B. Smith [mailto:[EMAIL PROTECTED] Sent: Tuesday, January 22, 2008 1:22 PM To: MS-Exchange Admin Issues Subject: RE: Event ID 9667 In general, any message accepted via SMTP (or via drop/pickup folders) is a non-promoted message until it is processed by the store. This means that it gets stored into the STM file in an Exchange 2003 database (this is an optimization for IMAP and POP3, but not for Outlook clients). There is no STM file in Exchange 2007, so all messages are automagically promoted to the MAPI property store. Every common header in a message stored in the database is assigned a property ID. Every X-* header is assigned a custom property ID. In general, even over millions of messages, there are only a few hundred X-* headers. What we are seeing more and more commonly, especially with message archiving and certain anti-spam solutions, is that they add a metric buttload of custom X-* headers. For example, X-00001, X-00002, ... X-99999, etc. etc. Not the values of the headers, but custom headers themselves (the parts before the colon in the textual representation of the message). Now, when you move a mailbox to another store, all the messages in that mailbox lose their custom properties (why, I dunno - that seems like a bug to me). That's the standard workaround. Once you've moved all the mailboxes out of the store with too many properties, you delete the store. MFCMAPI can show you all the named properties on a store. Regards, Michael B. Smith MCSE/Exchange MVP http://TheEssentialExchange.com From: Alex Alborzfard [mailto:[EMAIL PROTECTED] Sent: Tuesday, January 22, 2008 12:35 PM To: MS-Exchange Admin Issues Subject: Re: Event ID 9667 Here are the named properties it's trying to create: X-TM-IMSS-Message-ID X-Content-Filtered-By X-Original-Date X-TFF-CGPSA-Filter X-TFF-CGPSA-Version X-Puresend X-Fantasy-No-Post X-filenames By "it" do you mean EXCH or the spam appliance? According to the event log, the user attempting to create the named property is "SYSTEM". The mailbox is actually a folder under Public Folders. So you're saying the properties are not needed and by moving the mailbox to another store, they'll get removed? On Jan 22, 2008 11:59 AM, Michael B. Smith < [EMAIL PROTECTED]<mailto:[EMAIL PROTECTED]>> wrote: This almost certainly means that it is creating a custom X-* header. It shouldn't do that. To eliminate the properties, you can move a mailbox that contains the properties to another store. Regards, Michael B. Smith MCSE/Exchange MVP http://TheEssentialExchange.com From: Alex Alborzfard [mailto:[EMAIL PROTECTED]<mailto:[EMAIL PROTECTED]>] Sent: Tuesday, January 22, 2008 10:33 AM To: MS-Exchange Admin Issues Subject: Re: Event ID 9667 If you're referring to the number after quota limit, it's 8192. There are like 6 or 7 of these events with unique named properties in the APP log. >From the named properties, it seems that it has something to do with our spam >appliance. Thanks On Jan 22, 2008 9:38 AM, Michael B. Smith <[EMAIL PROTECTED]<mailto:[EMAIL PROTECTED]>> wrote: What's the number? You only get that warning when you are within 20% of the maximum limit. You need to figure out what's creating the named properties. Regards, Michael B. Smith MCSE/Exchange MVP http://TheEssentialExchange.com From: Alex Alborzfard [mailto:[EMAIL PROTECTED]<mailto:[EMAIL PROTECTED]>] Sent: Tuesday, January 22, 2008 9:33 AM To: MS-Exchange Admin Issues Subject: Event ID 9667 I'm getting this logged in Application log of one of our EX2K3 servers. I found a Technet article (http://technet.microsoft.com/en-us/library/bb851495.aspx ) that tells you to look for some registry values, which I cannot find. How can I fix this or it's not serious and I should just leave it alone? TIA ~ Ninja Email Security with Cloudmark Spam Engine Gets Image Spam ~ ~ http://www.sunbeltsoftware.com/Ninja ~
