Anti Spam is not working after upgrading to F-Secure Email and Server Security 14.00 - WithSecure Community
<main>
<article class="userContent">
<h3 data-version="6" data-article="000020676" data-id="issue">Issue:</h3>
<p></p><ul><li>After installation we noticed spam scanning was not working due to missing components. After a reboot of the ESS server downloads components from the Policy Manager Server and starts working as expected again</li><li>Spam filter is not working</li></ul><h3 data-id="resolution">Resolution:</h3>
<p>If you are experiencing any kind of Anti Spam related issues, first thing we advise is to troubleshoot the connectivity. You can refer to this <a rel="nofollow" href="https://community.f-secure.com/t5/Business-Suite/How-to-troubleshoot-Anti-Spam-on/ta-p/122258">article</a> for troubleshooting the connectivity.<br><br>If the troubleshooting was positive, and you still have issues with the filter, please follow the steps below to fix the problem.<br><br>You can verify the problem by opening the<b> TransportAgent.log </b>and check if you see errors like this:<br><i>2020-02-12 15:16:21.374 [8350.0111] *E: FSecure.AntiVirus.Exchange.Transport.FSItemScanner: Scan() Failed System.IO.FileNotFoundException: Cannot load dll 'nif2_api64.dll'<br>Dateiname: "nif2_api64.dll"<br>bei FSecure.Utils.DllLoader..ctor(String dll32, String dll64, UInt32 familyId)<br>bei FSecure.Api.AntiSpamApi.Nif2AntiSpamApi..ctor()<br>bei FSecure.AntiVirus.Exchange.Transport.FSSpamScanner.Scan(ManualResetEvent stopEvent)<br><br><b>Note: </b>TransportAgent.log can be found from </i>C:\Windows\ServiceProfiles\NetworkService\AppData\Local\F-Secure\Log\ess <br><br>To solve the problem, clear the setting <b>Notify administrator</b>. <b> </b>To apply this change, you need to use F-Secure Policy Manager Console:<br></p><ol><li>Open F-Secure Policy Manager Console</li><li>Highlight a host or policy domain from the Domain Tree</li><li>Go to the <b>Settings </b>tab and select <b>Standard view</b></li><li>Expand the <b>Microsoft Exchange</b> settings and go to <b>Incoming email</b></li><li>Scroll down to the <b>Archive scanning </b>section and disable the option <b>Notify administrator</b></li><li>Distribute the policy (Ctrl + D)</li></ol>
After you have distributed the policy, try to stimulate a "spam email" to see how the filter handles the spam now. Open the Web GUI and navigate to Spam Control and check the statistics "number of processed message and number of spam messages".<br><br>If the statistics are still 0, open TransportAgent.log again and check if you see similar errors: <br><br><i>2020-02-18 15:38:09.213 [35d0.0079] .W: FSecure.AntiVirus.Exchange.Transport.FSMessageScanner: SpamFiltering turned OFF, size:2401, max:1000</i> <br><i>2020-02-18 15:48:11.736 [35d0.0108] .W: FSecure.AntiVirus.Exchange.Transport.FSMessageScanner: SpamFiltering turned OFF, size:1831, max:1000</i>
<ul><li>FSMessageScanner: SpamFiltering turned OFF, size:<b>A</b>, max:<b>B</b> " meaning: message will not be scanned for spam cause it's size (<b>A</b> kb) exceeds maximum allowed message size (<b>B</b> Kb) to be scanned for SPAM.</li><li>windows.microsoft.exchange.transport_protection.inbound.spam_control.max_message_size: 222, this means messages larger then 222Kb will not be scanned for SPAM. <b>Appropriate setting could be changed.</b></li><li>The Transport Agent detects "X-MS-Exchange-Organization-SCL: -1" message header. "A -1 SCL would apply to email messages sent between recipients of the same Exchange organization, or messages from external senders that have been whitelisted in some way."</li><li>Also "X-MS-Exchange-Organization-SCL" header field is removed when a message enters some organisation. More information can be found here: <a rel="nofollow" href="https://social.technet.microsoft.com/Forums/ie/en-US/27bd3904-45b4-450a-a806-9c753f23753b/xmsexchangeorganizationscl-1?forum=exchangesvradminlegacy">https://social.technet.microsoft.com/Forums/ie/en-US/27bd3904-45b4-450a-a806-9c753f23753b/xmsexchangeorganizationscl-1?forum=exchangesvradminlegacy</a></li></ul><p>Article no: 000020676</p>
</article>
</main>