Video Screencast Help

EV9 - Journal Custom Filter Error

Created: 10 Sep 2012 • Updated: 15 Nov 2012 | 4 comments
SYMAJ's picture
This issue has been solved. See solution.

I have a site running EV9 on W2K3, two servers - one running Journal Archiving and one running Mailbox Archiving (Exchange 2010).  I recently implemented a custom filter for the Journal Archiving to eliminate some of the 'rubbish' which we don't want to archive from the journal.

I am getting errors, approx 3 times daily, whereby the attached errors are presented and a number of emails go to the 'Failed External Filter' folder in Outlook.  I cannot see anything common to these messages and also after looking within the forum nothing seems to apply such as AV stripping contents etc.  If I drop the 'failed' emails back into the inbox they process successfully the second time around.

I captured a DTRACE when the error occurred and have attached this, along with a few screenshots of errors in EV Event Log and also the rules xml file in use.

Any pointers would be appreciated as to how I can resolve this issue.


Files Attached:  Journal_2010.docx is a word version of the Journal_2010.xml filter rules file, EV Journal Filter Errors.docx is a number of screenshots of the errors presented in the EV Application Log, DTRACE Trace Log for Server.docx is an editied version of the DTRACE log for the time of the error.

Comments 4 CommentsJump to latest comment

Andrew G.'s picture

This looks like it's an error when the task is trying to find the list of internal domains. One of the MAPI calls to open a user object is failing, which results in not processing the item. It is not apparent what the problem actually is. Do you notice any other Exchange problems at the same time? Is there any maintenance scheduled for the time these errors occur? Anything to do with the address books for example?

In the version you are running (9.0.0), the internal domain list is reconstructed for each message processed when using a custom filter.

This was changed in 9.0.4 so that the domain list does not need to be reconstructed for every message. If possible, it could well be worth upgrading to 9.0.4 as the calls that are failing will be made much less frequently, and so it would be much less likely to fail to process individual messages.

SYMAJ's picture


I can't say we have noticed any other Exchange issues at the time of failures, nor any maintenance taking place.  These tend to happen several times per day, and usually around similar times (10am, 12pm).

Is the 904 upgrade a simple jump (haven't looked into it yet), or is there more to it ? 

I will shortly be planning a migration to EV10 for this site - but depending on scheduling it may be some months before implementation so would like to get this sorted first.



TonySterling's picture

Hey AJ,

Did you get any where with this?

The upgrade to 9 sp 4 is pretty straight forward, how many servers do you have?


SYMAJ's picture


After discussing the options with the customer they decided to put this on hold until the EV10 migration / upgrade - so no further action was taken.  I guess we will be planning the upgrade for early new year.  Two servers involved - One doing Journal Archive and one doing Mailbox Archive - EX2010 - also 1 DA server in the picture.