Tech Support

Monitoring Exchange 2003 IMF and RDNS Black Lists with WMI

Normally it isn’t easy to get SPAM stats out of Exchange 2003 for the Intelligent Message Filter (IMF). You know it is working but really have no idea what amount of email it is stopping from delivery. WMI to the rescue!

There is an object “Win32_PerfFormattedData_MSExchangeUCF_MSExchangeIntelligentMessageFilter” in the \root\cimv2 space that has a great list of readable properties — like: TotalMessagesScannedforUCE, TotalUCEMessagesActedUpon. With these two you can calculate the percentage of SPAM hitting your server that is detected by the IMF. Here at this value averages from 75% to 85%.

Here is another great object: “Win32_PerfFormattedData_TURFLIST_MSExchangeTransportFilterSink” which can give you similar information on RDNS Blacklist lookup rejects.