This article applies to:

• MailMarshal Exchange 5.3 and above
• Exchange 2007

Question:

• Why do Exchange logs show EventID FAIL for messages that are successfully processed by MailMarshal Exchange?

Information:

MailMarshal Exchange uses a supported method to perform content scanning of Exchange messages.

This method requires a new copy of each message to be created and queued for delivery, while the original copy of the message is dropped.

Exchange logs a FAIL event for the original message that is dropped.

The wording FAIL is misleading. The process that raises this event is normal and expected. The message is actually delivered.

The log information is similar to the following.

Timestamp : 23/09/2009 11:56:24 AM 
ClientIp : 
ClientHostname : exch01 
ServerIp : 
ServerHostname : 
SourceContext : MailMarshal Exchange Agent 
ConnectorId : 
Source : AGENT 
EventId : FAIL 
InternalMessageId : 638518 
MessageId : <892E57FB5CB5744195979250C4EF1999F08D2D62AB@EXCHANGE.example.com> 
Recipients : {some.body@example.com} 
RecipientStatus : {} 
TotalBytes : 11758 
RecipientCount : 1 
RelatedRecipientAddress : 
Reference : 
MessageSubject : Test Message
Sender : some.one.else@example.com
ReturnPath : some.one.else@example.com
MessageInfo : 

Note:

In the case of an actual Exchange delivery failure, the RecipientStatus field normally contains detailed information.