No need to apologize...in fact I should thank you for taking the time to educate me...Now I know how much I don't know!
As for MFCMAPI, I downloaded the tool, but I'm not sure how to use it. Do I need to install it on EXCH box or on a client and what option would I have to choose to see properties? What am I looking for? Since there are no servers to replicate PF to, what would be the consequences of leaving it as is, aside from the annoying errors in event log? Thanks again On Jan 22, 2008 1:29 PM, Michael B. Smith <[EMAIL PROTECTED]> wrote: > > > Sorry, I got carried away with the explanation and didn't answer the > questions… > > > > I would guess that the spam appliance is creating the custom properties, > but I don't know that for certain. Using MFCMAPI to examine the properties > is likely a good way to identify that. > > > > Most Exchange Services run as LocalSystem, so that is why you see SYSTEM > creating the properties. > > > > Custom properties are a store attribute. As far as I know (I could ping > someone at MSFT, but I don't know how long it would take to get a response > on this), there is no documented way to remove custom properties from a > store. I've always moved the content and deleted the store. With a PF, you'd > have to replicate it to another server instead of using Move Mailbox. > > > > Regards, > > > > Michael B. Smith > > MCSE/Exchange MVP > > http://TheEssentialExchange.com > > > > *From:* Michael B. Smith [mailto:[EMAIL PROTECTED] > *Sent:* Tuesday, January 22, 2008 1:22 PM > *To:* MS-Exchange Admin Issues > *Subject:* RE: Event ID 9667 > > > > > > In general, any message accepted via SMTP (or via drop/pickup folders) is > a non-promoted message until it is processed by the store. This means that > it gets stored into the STM file in an Exchange 2003 database (this is an > optimization for IMAP and POP3, but not for Outlook clients). There is no > STM file in Exchange 2007, so all messages are automagically promoted to the > MAPI property store. > > > > Every common header in a message stored in the database is assigned a > property ID. Every X-* header is assigned a custom property ID. In general, > even over millions of messages, there are only a few hundred X-* headers. > What we are seeing more and more commonly, especially with message archiving > and certain anti-spam solutions, is that they add a metric buttload of > custom X-* headers. For example, X-00001, X-00002, … X-99999, etc. etc. Not > the values of the headers, but custom headers themselves (the parts before > the colon in the textual representation of the message). > > > > Now, when you move a mailbox to another store, all the messages in that > mailbox lose their custom properties (why, I dunno – that seems like a bug > to me). That's the standard workaround. Once you've moved all the mailboxes > out of the store with too many properties, you delete the store. > > > > MFCMAPI can show you all the named properties on a store. > > > > Regards, > > > > Michael B. Smith > > MCSE/Exchange MVP > > http://TheEssentialExchange.com > > > > *From:* Alex Alborzfard [mailto:[EMAIL PROTECTED] > *Sent:* Tuesday, January 22, 2008 12:35 PM > *To:* MS-Exchange Admin Issues > *Subject:* Re: Event ID 9667 > > > > Here are the named properties it's trying to create: > X-TM-IMSS-Message-ID > X-Content-Filtered-By > X-Original-Date > X-TFF-CGPSA-Filter > X-TFF-CGPSA-Version > X-Puresend > X-Fantasy-No-Post > X-filenames > > By "it" do you mean EXCH or the spam appliance? According to the event > log, the user attempting to create the named property is "SYSTEM". > The mailbox is actually a folder under Public Folders. > > So you're saying the properties are not needed and by moving the mailbox > to another store, they'll get removed? > > On Jan 22, 2008 11:59 AM, Michael B. Smith <[EMAIL PROTECTED]> > wrote: > > > > This almost certainly means that it is creating a custom X-* header. It > shouldn't do that. > > > > To eliminate the properties, you can move a mailbox that contains the > properties to another store. > > > > Regards, > > > > Michael B. Smith > > MCSE/Exchange MVP > > http://TheEssentialExchange.com > > > > *From:* Alex Alborzfard [mailto:[EMAIL PROTECTED] > *Sent:* Tuesday, January 22, 2008 10:33 AM > > > *To:* MS-Exchange Admin Issues > > *Subject:* Re: Event ID 9667 > > > > If you're referring to the number after quota limit, it's 8192. There are > like 6 or 7 of these events with unique named properties in the APP log. > From the named properties, it seems that it has something to do with our > spam appliance. > > Thanks > > On Jan 22, 2008 9:38 AM, Michael B. Smith < > [EMAIL PROTECTED]> wrote: > > > > What's the number? You only get that warning when you are within 20% of > the maximum limit. > > > > You need to figure out what's creating the named properties. > > > > Regards, > > > > Michael B. Smith > > MCSE/Exchange MVP > > http://TheEssentialExchange.com > > > > *From:* Alex Alborzfard [mailto:[EMAIL PROTECTED] > *Sent:* Tuesday, January 22, 2008 9:33 AM > *To:* MS-Exchange Admin Issues > *Subject:* Event ID 9667 > > > > I'm getting this logged in Application log of one of our EX2K3 servers. > I found a Technet article > (http://technet.microsoft.com/en-us/library/bb851495.aspx > ) that tells you to look for some registry values, which I cannot find. > How can I fix this or it's not serious and I should just leave it alone? > > TIA > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > ~ Ninja Email Security with Cloudmark Spam Engine Gets Image Spam ~ ~ http://www.sunbeltsoftware.com/Ninja ~
