Monitoring Exchange 2003 IMF and RDNS Black Lists with WMI

Fri, 06 Apr 2007 01:33:00 GMT

Normally it isn't easy to get SPAM stats out of Exchange 2003 for the Intelligent Message Filter (IMF). You know it is working but really have no idea what amount of email it is stopping from delivery. WMI to the rescue!

There is an object "Win32_PerfFormattedData_MSExchangeUCF_MSExchangeIntelligentMessageFilter" in the \root\cimv2 space that has a great list of readable properties -- like: TotalMessagesScannedforUCE, TotalUCEMessagesActedUpon. With these two you can calculate the percentage of SPAM hitting your server that is detected by the IMF. Here at BigWindow.net this value averages from 75% to 85%.

Here is another great object: "Win32_PerfFormattedData_TURFLIST_MSExchangeTransportFilterSink" which can give you similar information on RDNS Blacklist lookup rejects.

Hertzler's Blog

Monitoring Exchange 2003 IMF and RDNS Black Lists with WMI