- After installation we noticed spam scanning was not working due to missing components. After a reboot of the ESS server downloads components from the Policy Manager Server and starts working as expected again
- Spam filter is not working
If you are experiencing any kind of Anti Spam related issues, first thing we advise is to troubleshoot the connectivity. You can refer to this article for troubleshooting the connectivity.
If the troubleshooting was positive, and you still have issues with the filter, please follow the steps below to fix the problem.
You can verify the problem by opening the TransportAgent.log and check if you see errors like this:
2020-02-12 15:16:21.374 [8350.0111] *E: FSecure.AntiVirus.Exchange.Transport.FSItemScanner: Scan() Failed System.IO.FileNotFoundException: Cannot load dll 'nif2_api64.dll'
bei FSecure.Utils.DllLoader..ctor(String dll32, String dll64, UInt32 familyId)
bei FSecure.AntiVirus.Exchange.Transport.FSSpamScanner.Scan(ManualResetEvent stopEvent)
Note: TransportAgent.log can be found from C:\Windows\ServiceProfiles\NetworkService\AppData\Local\F-Secure\Log\ess
To solve the problem, clear the setting Notify administrator. To apply this change, you need to use F-Secure Policy Manager Console:
After you have distributed the policy, try to stimulate a "spam email" to see how the filter handles the spam now. Open the Web GUI and navigate to Spam Control and check the statistics "number of processed message and number of spam messages".
- Open F-Secure Policy Manager Console
- Highlight a host or policy domain from the Domain Tree
- Go to the Settings tab and select Standard view
- Expand the Microsoft Exchange settings and go to Incoming email
- Scroll down to the Archive scanning section and disable the option Notify administrator
- Distribute the policy (Ctrl + D)
If the statistics are still 0, open TransportAgent.log again and check if you see similar errors:
2020-02-18 15:38:09.213 [35d0.0079] .W: FSecure.AntiVirus.Exchange.Transport.FSMessageScanner: SpamFiltering turned OFF, size:2401, max:1000
2020-02-18 15:48:11.736 [35d0.0108] .W: FSecure.AntiVirus.Exchange.Transport.FSMessageScanner: SpamFiltering turned OFF, size:1831, max:1000
- FSMessageScanner: SpamFiltering turned OFF, size:A, max:B " meaning: message will not be scanned for spam cause it's size (A kb) exceeds maximum allowed message size (B Kb) to be scanned for SPAM.
- windows.microsoft.exchange.transport_protection.inbound.spam_control.max_message_size: 222, this means messages larger then 222Kb will not be scanned for SPAM. Appropriate setting could be changed.
- The Transport Agent detects "X-MS-Exchange-Organization-SCL: -1" message header. "A -1 SCL would apply to email messages sent between recipients of the same Exchange organization, or messages from external senders that have been whitelisted in some way."
- Also "X-MS-Exchange-Organization-SCL" header field is removed when a message enters some organisation. More information can be found here: https://social.technet.microsoft.com/Forums/ie/en-US/27bd3904-45b4-450a-a806-9c753f23753b/xmsexchangeorganizationscl-1?forum=exchangesvradminlegacy
Article no: 000020676