Video Screencast Help

Archived files go to "Failed External Filter" folder.

Created: 09 Aug 2012 • Updated: 24 Dec 2012 | 14 comments
This issue has been solved. See solution.

I recently enabled a user's account for archiving, but whenever she tries to manually archive, the clock appears over the message and then the message goes into "Failed External Filter".  I checked the security logs on the EV server and it shows the user successfully logging in/out.  Just the one user.

Also, whenever the user tries to archive the following error pops up in the event viewer on the EV server: error 3263: "An error occurred processing the external filter 'EnterpriseVault.CustomFilter'.  No more filters will be processed." 

Comments 14 CommentsJump to latest comment

TonySterling's picture

Could you share some more details about your environment?

What version of EV?

What version of Outlook?

Do other users have the same problem?

What exactly does your custom filter do?

jmor2440's picture

Sure, thanks for taking the time to help.

EV 9.0.2

Outlook 2007

One user had the same problem a couple months ago and her archiving just started working on it's own a couple days later.  The only connection between these two users is that they both use workstations (90% of our users connect through Citrix)

TonySterling's picture

Thanks for that, can you post your custom filter rules?

jmor2440's picture

Wouldn't that be under "C:\program files\enterprise vault" on the EV server?

TonySterling's picture

It will be under *\Enterprise Vault\Custom Filter Rules folder.

jmor2440's picture

That's what I thought, there is no custom filter rules folder, just *\enterprise vault\deployment scanner.

All of the other users' are able to archive fine though.

TonySterling's picture

If all you have is Deployment Scanner that isn't your installation directory.

Is your server 64 bit?  If yes you need to look under \Program Files (x86)\ directory? You can also verify the install path from the registry.

jmor2440's picture

Sorry, it was on the E:.... 

There are 3 different files, which one do you need? (customproperties.xsd, default filter rules.xml, ruleset schema.xdr)

Also, would you like copy/paste or upload?

TonySterling's picture

No worries!  :)

Default Filter Rules, you can save it as a txt file and attach it. 

Rob.Wilcox's picture

I have the same problem in EV 9.0.3.

If you do a run-now against the mailbox it will work - I mean the rules will work - but if you do a manual archive, with ANY rule, then you get failures..

13408 08:22:16.277  [1044] (ArchiveTask) <948> EV:M CEVFilterController::ProcessAllFilters - Processing External Filter [EnterpriseVault.CustomFilter] - MailboxDN:[/o=First Organization/ou=Exchange Administrative Group (FYDIBOHF23SPDLT)/cn=Recipients/cn=Adele.Reinhardt] Folder:[ Inbox] Title:[test123]|
13409 08:22:16.277  [1044] (ArchiveTask) <948> EV:L {CEVFilterController::get_MAPIMessage()} (Entry)
13410 08:22:16.292  [1044] (ArchiveTask) <948> EV:M IsEnvelopeMessage - GetIDsFromNames returned 0x00000000
13411 08:22:16.292  [1044] (ArchiveTask) <948> EV:M IsEnvelopeMessage - Exiting Routine [IsEnvelope=False] [IsExchange2007=False] [0x80070057]
13412 08:22:16.292  [1044] (ArchiveTask) <948> EV:H {IsEnvelopeMessage} HRXEX fn trace : Returning error [0x80070057], [..\AgentsCommon\EnvelopeJournal.cpp, lines {436,545}, built Nov 11 21:02:46 2011].
13413 08:22:16.292  [1044] (ArchiveTask) <948> EV:M CEVFilterController::InitializeMAPIMessages - Call to IsEnvelopeMessage failed [0x80070057]
13414 08:22:16.292  [1044] (ArchiveTask) <948> EV:H {CEVFilterController::get_MAPIMessage()} (Exit) Status: [The parameter is incorrect.  (0x80070057)]
13415 08:22:16.292  [1044] (ArchiveTask) <948> EV:H {CFilter::ProcessFilter} HRXEX fn trace : Error [0x80070057], [.\Filter.cpp, lines {294,302}, built Nov 11 21:02:47 2011].
13416 08:22:16.292  [1044] (ArchiveTask) <948> EV~E Event ID: 45317 The custom filter could not process a message. |Error: The parameter is incorrect.  (0x80070057) |Internal References:  |Error [0x80070057] |{CFilter::ProcessFilter} [.\Filter.cpp, lines {294,302}, built Nov 11 21:02:47 2011] |
13417 08:22:16.292  [1044] (ArchiveTask) <948> EV:M CEVFilterController::ProcessAllFilters - Time Taken to Process External Filter [EnterpriseVault.CustomFilter]: [0.003950] seconds
Why is the task checking for Envelope Messages (ie journaling)?  I don't know.
I'd suggest speaking with Symantec Support ...
Another oddity I have seen is that the rule sometimes works fine, in that it doesn't cause an error, but when manually archiving an item, it will archive it (even where your rule says 'subject contains interscan = delete)..  but it works PROPERLY when you do a run-now on the mailbox.
jmor2440's picture

Ok, I will talk with support.  Thanks for your help and I will update this when I get an answer.

jmor2440's picture

No need to talk with support.  It seems that after the weekend backups and archiving ran, everything is working fine.  Not sure exactly what happened to fix it, but I will look into it.  Also, I was thinking that maybe b/c I did a local move for the user on Exchange server right before I enabled the account for archiving on the EV server, that may have been an issue... that they were so close together.  Any thoughts before I close this thread?

TonySterling's picture

That is a bit strange, I wonder if a couple of synchronizations just needed to take place.  Are you running Cached mode for Outlook?  It could be a delay in synching the hidden message on Exchange to local cache??