RE: Event ID 9667
You got the version of MFCMAPI (MAPI Editor) from CodePlex, right? You want to create a session, login, and open the relevant message store. Then you want to do a GetNamesfromIDs with the default parameters. It should work on any box where Outlook has been installed. Once the limit of named properties are exhausted, a store will no longer accept any messages that require the creation of a named property. So.it's non-optimal. Regards, Michael B. Smith MCSE/Exchange MVP http://TheEssentialExchange.com From: Alex Alborzfard [mailto:[EMAIL PROTECTED] Sent: Tuesday, January 22, 2008 5:02 PM To: MS-Exchange Admin Issues Subject: Re: Event ID 9667 No need to apologize...in fact I should thank you for taking the time to educate me...Now I know how much I don't know! As for MFCMAPI, I downloaded the tool, but I'm not sure how to use it. Do I need to install it on EXCH box or on a client and what option would I have to choose to see properties? What am I looking for? Since there are no servers to replicate PF to, what would be the consequences of leaving it as is, aside from the annoying errors in event log? Thanks again On Jan 22, 2008 1:29 PM, Michael B. Smith [EMAIL PROTECTED] wrote: Sorry, I got carried away with the explanation and didn't answer the questions. I would guess that the spam appliance is creating the custom properties, but I don't know that for certain. Using MFCMAPI to examine the properties is likely a good way to identify that. Most Exchange Services run as LocalSystem, so that is why you see SYSTEM creating the properties. Custom properties are a store attribute. As far as I know (I could ping someone at MSFT, but I don't know how long it would take to get a response on this), there is no documented way to remove custom properties from a store. I've always moved the content and deleted the store. With a PF, you'd have to replicate it to another server instead of using Move Mailbox. Regards, Michael B. Smith MCSE/Exchange MVP http://TheEssentialExchange.com From: Michael B. Smith [mailto:[EMAIL PROTECTED] Sent: Tuesday, January 22, 2008 1:22 PM To: MS-Exchange Admin Issues Subject: RE: Event ID 9667 In general, any message accepted via SMTP (or via drop/pickup folders) is a non-promoted message until it is processed by the store. This means that it gets stored into the STM file in an Exchange 2003 database (this is an optimization for IMAP and POP3, but not for Outlook clients). There is no STM file in Exchange 2007, so all messages are automagically promoted to the MAPI property store. Every common header in a message stored in the database is assigned a property ID. Every X-* header is assigned a custom property ID. In general, even over millions of messages, there are only a few hundred X-* headers. What we are seeing more and more commonly, especially with message archiving and certain anti-spam solutions, is that they add a metric buttload of custom X-* headers. For example, X-1, X-2, . X-9, etc. etc. Not the values of the headers, but custom headers themselves (the parts before the colon in the textual representation of the message). Now, when you move a mailbox to another store, all the messages in that mailbox lose their custom properties (why, I dunno - that seems like a bug to me). That's the standard workaround. Once you've moved all the mailboxes out of the store with too many properties, you delete the store. MFCMAPI can show you all the named properties on a store. Regards, Michael B. Smith MCSE/Exchange MVP http://TheEssentialExchange.com From: Alex Alborzfard [mailto:[EMAIL PROTECTED] Sent: Tuesday, January 22, 2008 12:35 PM To: MS-Exchange Admin Issues Subject: Re: Event ID 9667 Here are the named properties it's trying to create: X-TM-IMSS-Message-ID X-Content-Filtered-By X-Original-Date X-TFF-CGPSA-Filter X-TFF-CGPSA-Version X-Puresend X-Fantasy-No-Post X-filenames By it do you mean EXCH or the spam appliance? According to the event log, the user attempting to create the named property is SYSTEM. The mailbox is actually a folder under Public Folders. So you're saying the properties are not needed and by moving the mailbox to another store, they'll get removed? On Jan 22, 2008 11:59 AM, Michael B. Smith mailto:[EMAIL PROTECTED] [EMAIL PROTECTED] wrote: This almost certainly means that it is creating a custom X-* header. It shouldn't do that. To eliminate the properties, you can move a mailbox that contains the properties to another store. Regards, Michael B. Smith MCSE/Exchange MVP http://TheEssentialExchange.com From: Alex Alborzfard [mailto:[EMAIL PROTECTED] Sent: Tuesday, January 22, 2008 10:33 AM To: MS-Exchange Admin Issues Subject: Re: Event ID 9667 If you're referring to the number after quota limit, it's 8192. There are like 6 or 7 of these events with unique named properties in the APP log. From the named
RE: Event ID 9667
What's the number? You only get that warning when you are within 20% of the maximum limit. You need to figure out what's creating the named properties. Regards, Michael B. Smith MCSE/Exchange MVP http://TheEssentialExchange.com From: Alex Alborzfard [mailto:[EMAIL PROTECTED] Sent: Tuesday, January 22, 2008 9:33 AM To: MS-Exchange Admin Issues Subject: Event ID 9667 I'm getting this logged in Application log of one of our EX2K3 servers. I found a Technet article (http://technet.microsoft.com/en-us/library/bb851495.aspx ) that tells you to look for some registry values, which I cannot find. How can I fix this or it's not serious and I should just leave it alone? TIA ~ Ninja Email Security with Cloudmark Spam Engine Gets Image Spam ~ ~ http://www.sunbeltsoftware.com/Ninja~
Re: Event ID 9667
If you're referring to the number after quota limit, it's 8192. There are like 6 or 7 of these events with unique named properties in the APP log. From the named properties, it seems that it has something to do with our spam appliance. Thanks On Jan 22, 2008 9:38 AM, Michael B. Smith [EMAIL PROTECTED] wrote: What's the number? You only get that warning when you are within 20% of the maximum limit. You need to figure out what's creating the named properties. Regards, Michael B. Smith MCSE/Exchange MVP http://TheEssentialExchange.com *From:* Alex Alborzfard [mailto:[EMAIL PROTECTED] *Sent:* Tuesday, January 22, 2008 9:33 AM *To:* MS-Exchange Admin Issues *Subject:* Event ID 9667 I'm getting this logged in Application log of one of our EX2K3 servers. I found a Technet article (http://technet.microsoft.com/en-us/library/bb851495.aspx ) that tells you to look for some registry values, which I cannot find. How can I fix this or it's not serious and I should just leave it alone? TIA ~ Ninja Email Security with Cloudmark Spam Engine Gets Image Spam ~ ~ http://www.sunbeltsoftware.com/Ninja~
RE: Event ID 9667
This almost certainly means that it is creating a custom X-* header. It shouldn't do that. To eliminate the properties, you can move a mailbox that contains the properties to another store. Regards, Michael B. Smith MCSE/Exchange MVP http://TheEssentialExchange.com From: Alex Alborzfard [mailto:[EMAIL PROTECTED] Sent: Tuesday, January 22, 2008 10:33 AM To: MS-Exchange Admin Issues Subject: Re: Event ID 9667 If you're referring to the number after quota limit, it's 8192. There are like 6 or 7 of these events with unique named properties in the APP log. From the named properties, it seems that it has something to do with our spam appliance. Thanks On Jan 22, 2008 9:38 AM, Michael B. Smith [EMAIL PROTECTED] wrote: What's the number? You only get that warning when you are within 20% of the maximum limit. You need to figure out what's creating the named properties. Regards, Michael B. Smith MCSE/Exchange MVP http://TheEssentialExchange.com From: Alex Alborzfard [mailto:[EMAIL PROTECTED] Sent: Tuesday, January 22, 2008 9:33 AM To: MS-Exchange Admin Issues Subject: Event ID 9667 I'm getting this logged in Application log of one of our EX2K3 servers. I found a Technet article (http://technet.microsoft.com/en-us/library/bb851495.aspx ) that tells you to look for some registry values, which I cannot find. How can I fix this or it's not serious and I should just leave it alone? TIA ~ Ninja Email Security with Cloudmark Spam Engine Gets Image Spam ~ ~ http://www.sunbeltsoftware.com/Ninja~
Re: Event ID 9667
Here are the named properties it's trying to create: X-TM-IMSS-Message-ID X-Content-Filtered-By X-Original-Date X-TFF-CGPSA-Filter X-TFF-CGPSA-Version X-Puresend X-Fantasy-No-Post X-filenames By it do you mean EXCH or the spam appliance? According to the event log, the user attempting to create the named property is SYSTEM. The mailbox is actually a folder under Public Folders. So you're saying the properties are not needed and by moving the mailbox to another store, they'll get removed? On Jan 22, 2008 11:59 AM, Michael B. Smith [EMAIL PROTECTED] wrote: This almost certainly means that it is creating a custom X-* header. It shouldn't do that. To eliminate the properties, you can move a mailbox that contains the properties to another store. Regards, Michael B. Smith MCSE/Exchange MVP http://TheEssentialExchange.com *From:* Alex Alborzfard [mailto:[EMAIL PROTECTED] *Sent:* Tuesday, January 22, 2008 10:33 AM *To:* MS-Exchange Admin Issues *Subject:* Re: Event ID 9667 If you're referring to the number after quota limit, it's 8192. There are like 6 or 7 of these events with unique named properties in the APP log. From the named properties, it seems that it has something to do with our spam appliance. Thanks On Jan 22, 2008 9:38 AM, Michael B. Smith [EMAIL PROTECTED] wrote: What's the number? You only get that warning when you are within 20% of the maximum limit. You need to figure out what's creating the named properties. Regards, Michael B. Smith MCSE/Exchange MVP http://TheEssentialExchange.com *From:* Alex Alborzfard [mailto:[EMAIL PROTECTED] *Sent:* Tuesday, January 22, 2008 9:33 AM *To:* MS-Exchange Admin Issues *Subject:* Event ID 9667 I'm getting this logged in Application log of one of our EX2K3 servers. I found a Technet article (http://technet.microsoft.com/en-us/library/bb851495.aspx ) that tells you to look for some registry values, which I cannot find. How can I fix this or it's not serious and I should just leave it alone? TIA ~ Ninja Email Security with Cloudmark Spam Engine Gets Image Spam ~ ~ http://www.sunbeltsoftware.com/Ninja~
RE: Event ID 9667
Sorry, I got carried away with the explanation and didn't answer the questions. I would guess that the spam appliance is creating the custom properties, but I don't know that for certain. Using MFCMAPI to examine the properties is likely a good way to identify that. Most Exchange Services run as LocalSystem, so that is why you see SYSTEM creating the properties. Custom properties are a store attribute. As far as I know (I could ping someone at MSFT, but I don't know how long it would take to get a response on this), there is no documented way to remove custom properties from a store. I've always moved the content and deleted the store. With a PF, you'd have to replicate it to another server instead of using Move Mailbox. Regards, Michael B. Smith MCSE/Exchange MVP http://TheEssentialExchange.com From: Michael B. Smith [mailto:[EMAIL PROTECTED] Sent: Tuesday, January 22, 2008 1:22 PM To: MS-Exchange Admin Issues Subject: RE: Event ID 9667 In general, any message accepted via SMTP (or via drop/pickup folders) is a non-promoted message until it is processed by the store. This means that it gets stored into the STM file in an Exchange 2003 database (this is an optimization for IMAP and POP3, but not for Outlook clients). There is no STM file in Exchange 2007, so all messages are automagically promoted to the MAPI property store. Every common header in a message stored in the database is assigned a property ID. Every X-* header is assigned a custom property ID. In general, even over millions of messages, there are only a few hundred X-* headers. What we are seeing more and more commonly, especially with message archiving and certain anti-spam solutions, is that they add a metric buttload of custom X-* headers. For example, X-1, X-2, . X-9, etc. etc. Not the values of the headers, but custom headers themselves (the parts before the colon in the textual representation of the message). Now, when you move a mailbox to another store, all the messages in that mailbox lose their custom properties (why, I dunno - that seems like a bug to me). That's the standard workaround. Once you've moved all the mailboxes out of the store with too many properties, you delete the store. MFCMAPI can show you all the named properties on a store. Regards, Michael B. Smith MCSE/Exchange MVP http://TheEssentialExchange.com From: Alex Alborzfard [mailto:[EMAIL PROTECTED] Sent: Tuesday, January 22, 2008 12:35 PM To: MS-Exchange Admin Issues Subject: Re: Event ID 9667 Here are the named properties it's trying to create: X-TM-IMSS-Message-ID X-Content-Filtered-By X-Original-Date X-TFF-CGPSA-Filter X-TFF-CGPSA-Version X-Puresend X-Fantasy-No-Post X-filenames By it do you mean EXCH or the spam appliance? According to the event log, the user attempting to create the named property is SYSTEM. The mailbox is actually a folder under Public Folders. So you're saying the properties are not needed and by moving the mailbox to another store, they'll get removed? On Jan 22, 2008 11:59 AM, Michael B. Smith [EMAIL PROTECTED] mailto:[EMAIL PROTECTED] wrote: This almost certainly means that it is creating a custom X-* header. It shouldn't do that. To eliminate the properties, you can move a mailbox that contains the properties to another store. Regards, Michael B. Smith MCSE/Exchange MVP http://TheEssentialExchange.com From: Alex Alborzfard [mailto:[EMAIL PROTECTED] Sent: Tuesday, January 22, 2008 10:33 AM To: MS-Exchange Admin Issues Subject: Re: Event ID 9667 If you're referring to the number after quota limit, it's 8192. There are like 6 or 7 of these events with unique named properties in the APP log. From the named properties, it seems that it has something to do with our spam appliance. Thanks On Jan 22, 2008 9:38 AM, Michael B. Smith [EMAIL PROTECTED] wrote: What's the number? You only get that warning when you are within 20% of the maximum limit. You need to figure out what's creating the named properties. Regards, Michael B. Smith MCSE/Exchange MVP http://TheEssentialExchange.com From: Alex Alborzfard [mailto:[EMAIL PROTECTED] Sent: Tuesday, January 22, 2008 9:33 AM To: MS-Exchange Admin Issues Subject: Event ID 9667 I'm getting this logged in Application log of one of our EX2K3 servers. I found a Technet article (http://technet.microsoft.com/en-us/library/bb851495.aspx ) that tells you to look for some registry values, which I cannot find. How can I fix this or it's not serious and I should just leave it alone? TIA ~ Ninja Email Security with Cloudmark Spam Engine Gets Image Spam ~ ~ http://www.sunbeltsoftware.com/Ninja~
RE: Event ID 9667
In general, any message accepted via SMTP (or via drop/pickup folders) is a non-promoted message until it is processed by the store. This means that it gets stored into the STM file in an Exchange 2003 database (this is an optimization for IMAP and POP3, but not for Outlook clients). There is no STM file in Exchange 2007, so all messages are automagically promoted to the MAPI property store. Every common header in a message stored in the database is assigned a property ID. Every X-* header is assigned a custom property ID. In general, even over millions of messages, there are only a few hundred X-* headers. What we are seeing more and more commonly, especially with message archiving and certain anti-spam solutions, is that they add a metric buttload of custom X-* headers. For example, X-1, X-2, . X-9, etc. etc. Not the values of the headers, but custom headers themselves (the parts before the colon in the textual representation of the message). Now, when you move a mailbox to another store, all the messages in that mailbox lose their custom properties (why, I dunno - that seems like a bug to me). That's the standard workaround. Once you've moved all the mailboxes out of the store with too many properties, you delete the store. MFCMAPI can show you all the named properties on a store. Regards, Michael B. Smith MCSE/Exchange MVP http://TheEssentialExchange.com From: Alex Alborzfard [mailto:[EMAIL PROTECTED] Sent: Tuesday, January 22, 2008 12:35 PM To: MS-Exchange Admin Issues Subject: Re: Event ID 9667 Here are the named properties it's trying to create: X-TM-IMSS-Message-ID X-Content-Filtered-By X-Original-Date X-TFF-CGPSA-Filter X-TFF-CGPSA-Version X-Puresend X-Fantasy-No-Post X-filenames By it do you mean EXCH or the spam appliance? According to the event log, the user attempting to create the named property is SYSTEM. The mailbox is actually a folder under Public Folders. So you're saying the properties are not needed and by moving the mailbox to another store, they'll get removed? On Jan 22, 2008 11:59 AM, Michael B. Smith mailto:[EMAIL PROTECTED] [EMAIL PROTECTED] wrote: This almost certainly means that it is creating a custom X-* header. It shouldn't do that. To eliminate the properties, you can move a mailbox that contains the properties to another store. Regards, Michael B. Smith MCSE/Exchange MVP http://TheEssentialExchange.com From: Alex Alborzfard [mailto:[EMAIL PROTECTED] Sent: Tuesday, January 22, 2008 10:33 AM To: MS-Exchange Admin Issues Subject: Re: Event ID 9667 If you're referring to the number after quota limit, it's 8192. There are like 6 or 7 of these events with unique named properties in the APP log. From the named properties, it seems that it has something to do with our spam appliance. Thanks On Jan 22, 2008 9:38 AM, Michael B. Smith [EMAIL PROTECTED] wrote: What's the number? You only get that warning when you are within 20% of the maximum limit. You need to figure out what's creating the named properties. Regards, Michael B. Smith MCSE/Exchange MVP http://TheEssentialExchange.com From: Alex Alborzfard [mailto:[EMAIL PROTECTED] Sent: Tuesday, January 22, 2008 9:33 AM To: MS-Exchange Admin Issues Subject: Event ID 9667 I'm getting this logged in Application log of one of our EX2K3 servers. I found a Technet article (http://technet.microsoft.com/en-us/library/bb851495.aspx ) that tells you to look for some registry values, which I cannot find. How can I fix this or it's not serious and I should just leave it alone? TIA ~ Ninja Email Security with Cloudmark Spam Engine Gets Image Spam ~ ~ http://www.sunbeltsoftware.com/Ninja~
RE: Event ID 9667
2007 SP1 will fire events when named properties are created. I think the only option is moving mailboxes to another store as you have stated. Something like: Event Type:Information Event Source:MSExchangeIS Event Category:General Event ID: 9873 Date: 1/22/2008 Time: 1:10:35 PM User: N/A Computer: Description: A named property has been created for the database /o=Blackstone/ou=Exchange Administrative Group (FYDIBOHF23SPDLT)/cn=Configuration/cn=Servers/cn=Ely/cn=Microsoft Private MDB. ID: 0x9123 Named property GUID: 00020386---c000-0046 Named property name/ID: x-coolheader-sitenum The following user is attempting to create the named property: N/A Protocol: MAPI Client type: Transport Client version: 2049.0.33008.5 For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp. From: Michael B. Smith [mailto:[EMAIL PROTECTED] Sent: Tuesday, January 22, 2008 1:29 PM To: MS-Exchange Admin Issues Subject: RE: Event ID 9667 Sorry, I got carried away with the explanation and didn't answer the questions... I would guess that the spam appliance is creating the custom properties, but I don't know that for certain. Using MFCMAPI to examine the properties is likely a good way to identify that. Most Exchange Services run as LocalSystem, so that is why you see SYSTEM creating the properties. Custom properties are a store attribute. As far as I know (I could ping someone at MSFT, but I don't know how long it would take to get a response on this), there is no documented way to remove custom properties from a store. I've always moved the content and deleted the store. With a PF, you'd have to replicate it to another server instead of using Move Mailbox. Regards, Michael B. Smith MCSE/Exchange MVP http://TheEssentialExchange.com From: Michael B. Smith [mailto:[EMAIL PROTECTED] Sent: Tuesday, January 22, 2008 1:22 PM To: MS-Exchange Admin Issues Subject: RE: Event ID 9667 In general, any message accepted via SMTP (or via drop/pickup folders) is a non-promoted message until it is processed by the store. This means that it gets stored into the STM file in an Exchange 2003 database (this is an optimization for IMAP and POP3, but not for Outlook clients). There is no STM file in Exchange 2007, so all messages are automagically promoted to the MAPI property store. Every common header in a message stored in the database is assigned a property ID. Every X-* header is assigned a custom property ID. In general, even over millions of messages, there are only a few hundred X-* headers. What we are seeing more and more commonly, especially with message archiving and certain anti-spam solutions, is that they add a metric buttload of custom X-* headers. For example, X-1, X-2, ... X-9, etc. etc. Not the values of the headers, but custom headers themselves (the parts before the colon in the textual representation of the message). Now, when you move a mailbox to another store, all the messages in that mailbox lose their custom properties (why, I dunno - that seems like a bug to me). That's the standard workaround. Once you've moved all the mailboxes out of the store with too many properties, you delete the store. MFCMAPI can show you all the named properties on a store. Regards, Michael B. Smith MCSE/Exchange MVP http://TheEssentialExchange.com From: Alex Alborzfard [mailto:[EMAIL PROTECTED] Sent: Tuesday, January 22, 2008 12:35 PM To: MS-Exchange Admin Issues Subject: Re: Event ID 9667 Here are the named properties it's trying to create: X-TM-IMSS-Message-ID X-Content-Filtered-By X-Original-Date X-TFF-CGPSA-Filter X-TFF-CGPSA-Version X-Puresend X-Fantasy-No-Post X-filenames By it do you mean EXCH or the spam appliance? According to the event log, the user attempting to create the named property is SYSTEM. The mailbox is actually a folder under Public Folders. So you're saying the properties are not needed and by moving the mailbox to another store, they'll get removed? On Jan 22, 2008 11:59 AM, Michael B. Smith [EMAIL PROTECTED]mailto:[EMAIL PROTECTED] wrote: This almost certainly means that it is creating a custom X-* header. It shouldn't do that. To eliminate the properties, you can move a mailbox that contains the properties to another store. Regards, Michael B. Smith MCSE/Exchange MVP http://TheEssentialExchange.com From: Alex Alborzfard [mailto:[EMAIL PROTECTED]mailto:[EMAIL PROTECTED]] Sent: Tuesday, January 22, 2008 10:33 AM To: MS-Exchange Admin Issues Subject: Re: Event ID 9667 If you're referring to the number after quota limit, it's 8192. There are like 6 or 7 of these events with unique named properties in the APP log. From the named properties, it seems that it has something to do with our spam appliance. Thanks On Jan 22, 2008 9:38 AM, Michael B. Smith [EMAIL PROTECTED]mailto
Re: Event ID 9667
No need to apologize...in fact I should thank you for taking the time to educate me...Now I know how much I don't know! As for MFCMAPI, I downloaded the tool, but I'm not sure how to use it. Do I need to install it on EXCH box or on a client and what option would I have to choose to see properties? What am I looking for? Since there are no servers to replicate PF to, what would be the consequences of leaving it as is, aside from the annoying errors in event log? Thanks again On Jan 22, 2008 1:29 PM, Michael B. Smith [EMAIL PROTECTED] wrote: Sorry, I got carried away with the explanation and didn't answer the questions… I would guess that the spam appliance is creating the custom properties, but I don't know that for certain. Using MFCMAPI to examine the properties is likely a good way to identify that. Most Exchange Services run as LocalSystem, so that is why you see SYSTEM creating the properties. Custom properties are a store attribute. As far as I know (I could ping someone at MSFT, but I don't know how long it would take to get a response on this), there is no documented way to remove custom properties from a store. I've always moved the content and deleted the store. With a PF, you'd have to replicate it to another server instead of using Move Mailbox. Regards, Michael B. Smith MCSE/Exchange MVP http://TheEssentialExchange.com *From:* Michael B. Smith [mailto:[EMAIL PROTECTED] *Sent:* Tuesday, January 22, 2008 1:22 PM *To:* MS-Exchange Admin Issues *Subject:* RE: Event ID 9667 In general, any message accepted via SMTP (or via drop/pickup folders) is a non-promoted message until it is processed by the store. This means that it gets stored into the STM file in an Exchange 2003 database (this is an optimization for IMAP and POP3, but not for Outlook clients). There is no STM file in Exchange 2007, so all messages are automagically promoted to the MAPI property store. Every common header in a message stored in the database is assigned a property ID. Every X-* header is assigned a custom property ID. In general, even over millions of messages, there are only a few hundred X-* headers. What we are seeing more and more commonly, especially with message archiving and certain anti-spam solutions, is that they add a metric buttload of custom X-* headers. For example, X-1, X-2, … X-9, etc. etc. Not the values of the headers, but custom headers themselves (the parts before the colon in the textual representation of the message). Now, when you move a mailbox to another store, all the messages in that mailbox lose their custom properties (why, I dunno – that seems like a bug to me). That's the standard workaround. Once you've moved all the mailboxes out of the store with too many properties, you delete the store. MFCMAPI can show you all the named properties on a store. Regards, Michael B. Smith MCSE/Exchange MVP http://TheEssentialExchange.com *From:* Alex Alborzfard [mailto:[EMAIL PROTECTED] *Sent:* Tuesday, January 22, 2008 12:35 PM *To:* MS-Exchange Admin Issues *Subject:* Re: Event ID 9667 Here are the named properties it's trying to create: X-TM-IMSS-Message-ID X-Content-Filtered-By X-Original-Date X-TFF-CGPSA-Filter X-TFF-CGPSA-Version X-Puresend X-Fantasy-No-Post X-filenames By it do you mean EXCH or the spam appliance? According to the event log, the user attempting to create the named property is SYSTEM. The mailbox is actually a folder under Public Folders. So you're saying the properties are not needed and by moving the mailbox to another store, they'll get removed? On Jan 22, 2008 11:59 AM, Michael B. Smith [EMAIL PROTECTED] wrote: This almost certainly means that it is creating a custom X-* header. It shouldn't do that. To eliminate the properties, you can move a mailbox that contains the properties to another store. Regards, Michael B. Smith MCSE/Exchange MVP http://TheEssentialExchange.com *From:* Alex Alborzfard [mailto:[EMAIL PROTECTED] *Sent:* Tuesday, January 22, 2008 10:33 AM *To:* MS-Exchange Admin Issues *Subject:* Re: Event ID 9667 If you're referring to the number after quota limit, it's 8192. There are like 6 or 7 of these events with unique named properties in the APP log. From the named properties, it seems that it has something to do with our spam appliance. Thanks On Jan 22, 2008 9:38 AM, Michael B. Smith [EMAIL PROTECTED] wrote: What's the number? You only get that warning when you are within 20% of the maximum limit. You need to figure out what's creating the named properties. Regards, Michael B. Smith MCSE/Exchange MVP http://TheEssentialExchange.com *From:* Alex Alborzfard [mailto:[EMAIL PROTECTED] *Sent:* Tuesday, January 22, 2008 9:33 AM *To:* MS-Exchange Admin Issues *Subject:* Event ID 9667 I'm getting this logged in Application log of one of our EX2K3 servers. I
