A number of emails failed to be processed by GFI MailEssentials

While generally the issue should be resolved with vendor and can be caused by one of antivirus engines breaking things… the real issue has to be fixed as over 500 emails were stopped before being deliverd.

Actually this 500 emails became 1200 in just few hours. Fortunately the fix is pretty simple.

Files .PROP can be freely deleted (you can leave them for gfi to verify things)

Files .TXT are standard .EML emails

So now that we know that .TXT files are your standard emails we can simply pass them to Exchange to be reprocessed. You can do that by renaming file extension from .txt to .eml and putting them in

C:\Program Files\Microsoft\Exchange Server\V15\TransportRoles\Replay folder. If everything is ok, you should notice the file extension changing from .eml to .tmp finally getting removed. If things go wrong the file extension will change from .eml to .bad. If that happens… well you're out of luck. But do not worry, this usually means the email format is bad and therefore it wouldn't pass to Exchange anyways.

While doing this manually is one way you can actually script this a bit. You can create .cmd file and execute following:

REM Processing Files 
cd C:\Program Files (x86)\GFI\MailEssentials\EmailSecurity\FailedMails
ren *.txt *.eml
pause
del *.prop
pause
move "C:\Program Files (x86)\GFI\MailEssentials\EmailSecurity\FailedMails\*.eml" "C:\Program Files\Microsoft\Exchange Server\V15\TransportRoles\Replay\"
pause

REM This part should be used only to retry reprocessing BAD files. Don't think it will change much but you can always try.

cd C:\Program Files\Microsoft\Exchange Server\V15\TransportRoles\Replay
ren *.bad *.eml
pause

Please notice use of PAUSE. This makes sure you can see your results before continuing.. you can remove PAUSE if you're sure what you're doing. The only problem with this solution is that when you push out 1200 emails to replay folder you will get a large queue of emails. In efforts to get things a bit more automated and at same time not filling up your queue too fast I've decided to write this powershell script. Keep in mind it's untested as the scenario didn't happen for 3rd time yet. Goal for this script was to set it up as task scheduled and have it running every few hours to fix the failed folder automatically. When GFI freaks out again I will rework this script to be fully tested. At the moment use it on your own risk (or use the script above – that one works).

$FailedFolder = "C:\Program Files (x86)\GFI\MailEssentials\EmailSecurity\FailedMails"
$ReplayFolder = "C:\Program Files\Microsoft\Exchange Server\V15\TransportRoles\Replay"
$LimitBad = 30
$LimitAll = 70
$LimitFailed = 50

function CountProcessedFiles() {
    $ReplayFiles = Get-ChildItem -Path $ReplayFolder | Where-Object {$_.Extension -eq ".TMP"}
    $AllFiles = Get-ChildItem -Path $ReplayFolder 
    if ($AllFiles.Count -gt $LimitAll) {
        $AllFiles.Count
        return $AllFiles.Count
    }
    else {
        return $ReplayFiles.Count
    }    
}
function CountProcessedBadFiles(){
    $BadFiles = Get-ChildItem -Path $ReplayFolder  | Where-Object {$_.Extension -eq ".BAD"}
    return $BadFiles.Count
}

function DoWork() {
    $RemoveFiles = Get-ChildItem -Path $FailedFolder | Where-Object {$_.Extension -eq ".PROP"}
    ForEach ($file in $RemoveFiles) {
        remove-item $file.fullname
    }

    $FailedFiles = Get-ChildItem -Path $FailedFolder | Where-Object {$_.Extension -eq ".txt"}
    ForEach ($file in $FailedFiles) {
        $fullNameOld = $FailedFolder + "\" + $file.Name
        $fullNameNew = $FailedFolder + "\" + $file.Name + ".eml"
        Rename-Item $fullNameOld $fullNameNew
        Move-Item -Path $fullNameNew -Destination $ReplayFolder

        #Pause
        while (CountProcessedFiles -gt $LimitFailed) {
            Start-Sleep -Seconds 1
            $countProcessed = CountProcessedFiles
            $countBad = CountProcessedBadFiles
            Write-Host "Waiting... $countProcessed $countBad" 
        }
    }
}

DoWork