Video Screencast Help

Journaltask.exe high CPU and Symantec Mail Security for Exchange

Created: 19 Feb 2013 • Updated: 01 Mar 2013 | 4 comments
This issue has been solved. See solution.

JournalTask.exe get hung at 95%-99% CPU and no longer archiving.  Journal will not archive till I restart the task.  After journal archived, there are few journal email sitting in the inbox.  The EV server gets the following error message from the Event Viewer:

                Event ID: 3263

An error occurred processing the external filter 'EnterpriseVault.CustomFilter'.  No more filters will be processed.

Error:  already exists.  (0x80030050)

Mailbox: /O=Local/OU=EXCHANGE ADMINISTRATIVE GROUP (FYDIBOHF23SPDLT)/CN=RECIPIENTS/CN=Journal

Message Folder: ?Inbox

Message Title: Re: Computer Purchase Program

 

Event ID 45317

The custom filter could not process a message.

Error:  already exists.  (0x80030050)

Internal References: 

Error [0x80030050]

{CFilter::ProcessFilter} [.\Filter.cpp, lines {259,267}, built Sep 12 21:03:51 2012]

 

Symantec Mail Security for Exchange quarantined the attachment and replaces it with the text.

 

How can I get the EV to work with Symantec Mail Security for Exchange?

 

Discussion Filed Under:

Comments 4 CommentsJump to latest comment

JesusWept3's picture

Can you get the mail security to stop scanning the journal mailbox?
Even if you could, i'm not sure that you'd want to....what i'd be interested in knowing is whether its the EV Activity that is causing the scans of the items and quarantines or whether the items being quarantined are genuinely bad items etc

But honestly, your best bet is to give symantec a call and determine what the next steps should be, hopefully EV support and mail security support can work together to resolve it

And just as a matter of interest, what are the filters that you are using for the journal?

jdewing's picture

We don't want to stop the scanning.  Below is the example what i'm using for filter..

<?xml version="1.0"?>
<RULE_SET xmlns="x-schema:ruleset schema.xdr">

<!--Author Rule: This rule will not archive based on author criteria -->
    
     <RULE NAME="Alert Notification author" ACTION="MOVE_DELETED_ITEMS">
        <AUTHOR INCLUDES="ANY">
            <EA>Alert01@ad.local</EA>
            <EA>Alert02@ad.local</EA>
            <EA>Alert03@ad.local</EA>     
        </AUTHOR>
    </RULE>

<!--Subject Rule: This rule will not archive based on subject criteria -->

    <RULE NAME="Alert Notification Subject" ACTION="MOVE_DELETED_ITEMS">
        <SUBJECTS INCLUDES="ANY">
            <SUBJ MATCH="CONTAINS">Spam Quarantine Notification</SUBJ>
            <SUBJ MATCH="EXACT">Undeliverable_1</SUBJ>
        </SUBJECTS>
    </RULE>

<!--Example Rule 2: This rule will exclude any email from archiving if it is sent to someone in the Employee Benefits distribution list. -->

    <RULE NAME="Distribution LIst" ACTION="MOVE_DELETED_ITEMS">
        <AUTHOR>
            <DL>Enterprise Vault Excluded</DL>
        </AUTHOR>
    </RULE>
</RULE_SET>

JesusWept3's picture

OK then your best bet is to contact symantec support and see if EV Support and Mail security support can work together and try and determine what the issue is and how best to move forward

SOLUTION
Rob.Wilcox's picture

What versions of the software(s) are we talking about, and what version of Exchange?

Is there a way to configure Symantec Mail Security for Exchange to remove the 'whole' message, for quarantine, rather than replacing for text?