Disabling Symantec Mail Security for MS Exchange (v4.6.1.107)  notification in WinServ2K3 event log

Posted on 2006-03-20
Last Modified: 2008-01-09
I have recently enstated a standard spam subpolicy in Symantec Mail Security for MS Exchange - version  SMSMSE is installed on a Windows Server 2003 environment.  The subpolicy is set to scan incoming SMTP traffic, weed out the spam, and delete it automatically.  In regards to the mechanism, it works well.  The problem is that SMSMSE is sending sending a notification to the Windows event log with every message that is blocked.  These notifications are overwhelming the event log and to be honest, I don't even want to know if a spam message is deleted.

The event log info is as follows:

Type: Warning
Source: Symantec Mail Security for Microsoft Exchange
Category: Content Filtering Rules
Event ID: 291
Description: The message "%message%" located in SMTP has violated the following policy settings:
                         Policy: Standard
                         SubPolicy: Filtering SubPolicy
                         Rule: Spam
                   The following actions wer taken on it:
                         The message "%message%" was marked for deletion for the following reason(s):
                                 A filtering rule was violated.

I have disabled ALL notification options in the SMSMSE console for the spam subpolicy, yet I still receive these notifications in the event log, to the tune of about 100 a day.

What simple thing am I missing that would enable me to turn off these notifications?
Question by:Sturgeon1483
    LVL 1

    Expert Comment

    under Global>Configuration>Heuristic Antispam Engine> do you have Log regected messages selected?

    Author Comment

    I just checked and no, that option is not selected.  The only boxes checked under heuristic antispam engine settings are to enable the heuristics and to tag the message subject with a spam label.

    "Log rejected messages" is not selected.
    LVL 4

    Accepted Solution

    You have to live with it unfortunately...There may be a way to do this in the registry but no way to do so in the interface.  Sorry.  I have even spoke to Symantec technicians about this one.

    Author Comment

    Hmm, that's too bad.  Though your explanation would explain why I've had no luck finding a solution.  Thanks for the info.
    LVL 4

    Expert Comment

    I know it is a bummer...There has to be a way to hack the registry or something to do this this though.  What I am afraid of is that if there is a way to disable writing to the windows event log it will disable all and not just for the one policy.  This would not be helpful as you may want to view some of the other stuff written to the event log from SMSMSE.  If I find a better answer I will post it but I am not getting my hopes up to high on this one.  Like I said Symantec technicians couldn't even help on this one.

    wish I had more!

    Write Comment

    Please enter a first name

    Please enter a last name

    We will never share this with anyone.

    Featured Post

    Maximize Your Threat Intelligence Reporting

    Reporting is one of the most important and least talked about aspects of a world-class threat intelligence program. Here’s how to do it right.

    This article shows how to convert a multi-page PDF file into multiple image files, with one image file created for each page of the PDF. It does this by utilizing an excellent, free software package called GraphicsMagick. The solution is amazingly s…
    A list of useful business intelligence software.
    The viewer will learn how to successfully download and install the SARDU utility on Windows 7, without downloading adware.
    XMind Plus helps organize all details/aspects of any project from large to small in an orderly and concise manner. If you are working on a complex project, use this micro tutorial to show you how to make a basic flow chart. The software is free when…

    761 members asked questions and received personalized solutions in the past 7 days.

    Join the community of 500,000 technology professionals and ask your questions.

    Join & Ask a Question

    Need Help in Real-Time?

    Connect with top rated Experts

    11 Experts available now in Live!

    Get 1:1 Help Now