This article applies to:
- MailMarshal Exchange 5.3 and above
- Exchange 2007
Question:
- Why do Exchange logs show EventID FAIL for messages that are successfully processed by MailMarshal Exchange?
Information:
MailMarshal Exchange uses a supported method to perform content scanning of Exchange messages.
This method requires a new copy of each message to be created and queued for delivery, while the original copy of the message is dropped.
Exchange logs a FAIL event for the original message that is dropped.
The wording FAIL is misleading. The process that raises this event is normal and expected. The message is actually delivered.
The log information is similar to the following.
Timestamp : 23/09/2009 11:56:24 AM
ClientIp :
ClientHostname : exch01
ServerIp :
ServerHostname :
SourceContext : MailMarshal Exchange Agent
ConnectorId :
Source : AGENT
EventId : FAIL
InternalMessageId : 638518
MessageId : <892E57FB5CB5744195979250C4EF1999F08D2D62AB@EXCHANGE.example.com>
Recipients : {some.body@example.com}
RecipientStatus : {}
TotalBytes : 11758
RecipientCount : 1
RelatedRecipientAddress :
Reference :
MessageSubject : Test Message
Sender : some.one.else@example.com
ReturnPath : some.one.else@example.com
MessageInfo :
Note:
In the case of an actual Exchange delivery failure, the RecipientStatus field normally contains detailed information.