GfiMeSmtpAgent timing out due to Directory Harvesting

Versions / Builds Affected

Version 20.1 (build 20160420)

Status

Open

Problem Summary

GfiMeSmtpAgent timing out due to Directory Harvesting

TT / JIRAID

GFIME-909

How to Identify

Customer will approach us stating Exchange Submission Queue is growing large or there is slow/no mailflow. Event Logs show the below constantly: Application Event Log. Log Name:Application Source: MSExchange Extensibility Data: 2016-05-19 14:23:51 Event ID:1050 Category:(1) Level: Warning Keywords:Klasyczny User: N/A Computer: EDGE.***.* Description: The execution time of agent 'GfiMeSmtpAgent' exceeded 90000 milliseconds while handling event 'OnDataCommand' for message with InternetMessageId: 'Not Available'. This is an unusual amount of time for an agent to process a single event. However, Transport will continue processing this message. ------------------------------ The execution time of agent 'GfiMeSmtpAgent' exceeded 286915,2 milliseconds while handling event 'OnDataCommand' for message with InternetMessageId: 'Not Available'. This is an unusual amount of time for an agent to process a single event. However, Transport will continue processing this message. AntiSpam/Debuglogs/ase_dirharvest.gfi_log reveals a 10 second or over delay to resolve recipients: 2016-06-28,15:54:19,192,1,"#000015cc","#00001dd0","info ","ase_dirharvest","1.Checking if user dominik.korzen@polskieeplatnosci.pl exists" 2016-06-28,15:54:32,707,1,"#000015cc","#00001dd0","info ","ase_dirharvest","2.User exists" 2016-06-28,15:53:38,221,1,"#000015cc","#00001cf8","info ","ase_dirharvest","1.Checking if user artur.chudy@pep.pl exists" 2016-06-28,15:53:51,720,1,"#000015cc","#00001cf8","info ","ase_dirharvest","2.User exists"

Workaround / Fix Details

Setting DH to filter in Full Email mode should help for now (or disable the filter altogether): Anti-Spam > Filter Priority > SMTP Transmission Filtering tab Alternatively the Agent can be disabled until we come up with a fix (most suitable for customers with EmailSecurity only license), run the below in Exchange Shell: Disable-TransportAgent -Identity "GfiMeSmtpAgent" Restart Transport Service.

Required Actions

- Update Case Subject to "GfiMeSmtpAgent timing out due to Directory Harvesting" - Assign case to PSG