Video Screencast Help
Search Video Help Close Back
to help

Archived files go to "Failed External Filter" folder.

Created: 09 Aug 2012 | Updated: 24 Dec 2012 | 14 comments
jmor2440's picture
0 0 Votes
Login to vote
This issue has been solved. See solution.

I recently enabled a user's account for archiving, but whenever she tries to manually archive, the clock appears over the message and then the message goes into "Failed External Filter".  I checked the security logs on the EV server and it shows the user successfully logging in/out.  Just the one user.

Also, whenever the user tries to archive the following error pops up in the event viewer on the EV server: error 3263: "An error occurred processing the external filter 'EnterpriseVault.CustomFilter'.  No more filters will be processed." 

Comments 14 CommentsJump to latest comment

TonySterling's picture

Could you share some more details about your environment?

What version of EV?

What version of Outlook?

Do other users have the same problem?

What exactly does your custom filter do?

Tony Sterling
www.bluesource.net or www.bluesource.co.uk
Offices in the US and the UK

0
Login to vote
  • Actions
jmor2440's picture

Sure, thanks for taking the time to help.

EV 9.0.2

Outlook 2007

One user had the same problem a couple months ago and her archiving just started working on it's own a couple days later.  The only connection between these two users is that they both use workstations (90% of our users connect through Citrix)

0
Login to vote
  • Actions
TonySterling's picture

Thanks for that, can you post your custom filter rules?

Tony Sterling
www.bluesource.net or www.bluesource.co.uk
Offices in the US and the UK

0
Login to vote
  • Actions
jmor2440's picture

Wouldn't that be under "C:\program files\enterprise vault" on the EV server?

0
Login to vote
  • Actions
TonySterling's picture

It will be under *\Enterprise Vault\Custom Filter Rules folder.

Tony Sterling
www.bluesource.net or www.bluesource.co.uk
Offices in the US and the UK

0
Login to vote
  • Actions
jmor2440's picture

That's what I thought, there is no custom filter rules folder, just *\enterprise vault\deployment scanner.

All of the other users' are able to archive fine though.

0
Login to vote
  • Actions
TonySterling's picture

If all you have is Deployment Scanner that isn't your installation directory.

Is your server 64 bit?  If yes you need to look under \Program Files (x86)\ directory? You can also verify the install path from the registry.

 

Tony Sterling
www.bluesource.net or www.bluesource.co.uk
Offices in the US and the UK

0
Login to vote
  • Actions
jmor2440's picture

Sorry, it was on the E:.... 

There are 3 different files, which one do you need? (customproperties.xsd, default filter rules.xml, ruleset schema.xdr)

Also, would you like copy/paste or upload?

0
Login to vote
  • Actions
TonySterling's picture

No worries!  :)

Default Filter Rules, you can save it as a txt file and attach it. 

Tony Sterling
www.bluesource.net or www.bluesource.co.uk
Offices in the US and the UK

0
Login to vote
  • Actions
jmor2440's picture

Not sure, there isn't much in here.

AttachmentSize
Default Filter Rules.txt 662 bytes
0
Login to vote
  • Actions
Rob.Wilcox's picture

I have the same problem in EV 9.0.3.

 

If you do a run-now against the mailbox it will work - I mean the rules will work - but if you do a manual archive, with ANY rule, then you get failures..

 

 

13408 08:22:16.277  [1044] (ArchiveTask) <948> EV:M CEVFilterController::ProcessAllFilters - Processing External Filter [EnterpriseVault.CustomFilter] - MailboxDN:[/o=First Organization/ou=Exchange Administrative Group (FYDIBOHF23SPDLT)/cn=Recipients/cn=Adele.Reinhardt] Folder:[ Inbox] Title:[test123]|
13409 08:22:16.277  [1044] (ArchiveTask) <948> EV:L {CEVFilterController::get_MAPIMessage()} (Entry)
13410 08:22:16.292  [1044] (ArchiveTask) <948> EV:M IsEnvelopeMessage - GetIDsFromNames returned 0x00000000
13411 08:22:16.292  [1044] (ArchiveTask) <948> EV:M IsEnvelopeMessage - Exiting Routine [IsEnvelope=False] [IsExchange2007=False] [0x80070057]
13412 08:22:16.292  [1044] (ArchiveTask) <948> EV:H {IsEnvelopeMessage} HRXEX fn trace : Returning error [0x80070057], [..\AgentsCommon\EnvelopeJournal.cpp, lines {436,545}, built Nov 11 21:02:46 2011].
13413 08:22:16.292  [1044] (ArchiveTask) <948> EV:M CEVFilterController::InitializeMAPIMessages - Call to IsEnvelopeMessage failed [0x80070057]
13414 08:22:16.292  [1044] (ArchiveTask) <948> EV:H {CEVFilterController::get_MAPIMessage()} (Exit) Status: [The parameter is incorrect.  (0x80070057)]
13415 08:22:16.292  [1044] (ArchiveTask) <948> EV:H {CFilter::ProcessFilter} HRXEX fn trace : Error [0x80070057], [.\Filter.cpp, lines {294,302}, built Nov 11 21:02:47 2011].
13416 08:22:16.292  [1044] (ArchiveTask) <948> EV~E Event ID: 45317 The custom filter could not process a message. |Error: The parameter is incorrect.  (0x80070057) |Internal References:  |Error [0x80070057] |{CFilter::ProcessFilter} [.\Filter.cpp, lines {294,302}, built Nov 11 21:02:47 2011] |
13417 08:22:16.292  [1044] (ArchiveTask) <948> EV:M CEVFilterController::ProcessAllFilters - Time Taken to Process External Filter [EnterpriseVault.CustomFilter]: [0.003950] seconds
 
Why is the task checking for Envelope Messages (ie journaling)?  I don't know.
 
I'd suggest speaking with Symantec Support ...
 
Another oddity I have seen is that the rule sometimes works fine, in that it doesn't cause an error, but when manually archiving an item, it will archive it (even where your rule says 'subject contains interscan = delete)..  but it works PROPERLY when you do a run-now on the mailbox.

Many Thanks,

Rob

www.quadrotech-it.com - All your EV Tools

PS I hope that the post proves helpful.

0
Login to vote
  • Actions
jmor2440's picture

Ok, I will talk with support.  Thanks for your help and I will update this when I get an answer.

0
Login to vote
  • Actions
jmor2440's picture

No need to talk with support.  It seems that after the weekend backups and archiving ran, everything is working fine.  Not sure exactly what happened to fix it, but I will look into it.  Also, I was thinking that maybe b/c I did a local move for the user on Exchange server right before I enabled the account for archiving on the EV server, that may have been an issue... that they were so close together.  Any thoughts before I close this thread?

0
Login to vote
  • Actions
TonySterling's picture

That is a bit strange, I wonder if a couple of synchronizations just needed to take place.  Are you running Cached mode for Outlook?  It could be a delay in synching the hidden message on Exchange to local cache??

Tony Sterling
www.bluesource.net or www.bluesource.co.uk
Offices in the US and the UK

SOLUTION
0
Login to vote
  • Actions