Hello. My organisation has one forest containing two domains. The two domains correspond to two different geographical locations.
In the domain I manage, I have two Exchange 2013 CU7 Standard servers in a DAG. Both servers have both the CAS and Mailbox roles installed. The servers are running Server 2012 Standard. The two servers are on different subnets. One server, which is usually our active mailbox server, is at our primary data centre. The other server is at a standby data centre. The two sites are separated by a WAN link.
The other domain in the forest has one Exchange 2007 server, as well as two Exchange 2013 CU7 servers in a DAG.
On the Exchange servers in the domain I administer, an Event ID 4010 and an Event ID 2213 error will, intermittently, be logged at the same time. This happens only on the server that holds the passive copy of the Exchange databases.
The source of the Event ID 4010 errors is listed as MSExchange Messaging Policies. The following is an example of the start of one of those very long error messages.
Transport engine failed to evaluate condition due to Filtering Service error. The rule is configured to ignore errors. Details: 'Organization: '' Message ID '<f1e9948247ce43b98c6d7c03bdc213dc@serverFQDN>' Rule ID '03c1629b-6112-441b-83e4-3a6d70ee1701'
Predicate 'isInternal' Action ''. FilteringServiceFailureException Error: Microsoft.Exchange.MessagingPolicies.Rules.FilteringServiceFailureException: FIPS text extraction failed with error: 'Scan request timed out: STREAMS
The source of the Event ID 2213 error is FIPFS (Filtering Management Service). The following is an example of the Event ID 2213 error.
A scan request timed out. ID={745d17ec-b298-47ea-8058-3f1c3499b404}, WorkloadID=<f1e9948247ce43b98c6d7c03bdc213dc@serverFQDN>, PID=8944
Running Get-ContentFilterConfig | fl shows that the filtering has the default settings, as shown below.
Enabled : False
ExternalMailEnabled : True
InternalMailEnabled : False
Our organisation has a third party malware scanning system.
That system is managed by the administrators of the other domain in the forest. They are also responsible for general forest-wide operations. Because of the third party system, I don’t believe that our organisation actually needs the Exchange content filtering, but if it can be left with the default settings without causing the
problems identified in the errors I have reported, that would probably be ideal.
If you have any insights into the cause of these errors, and how to resolve them, please share them with me. Thanks.