Processing nodes use all available memory and become unresponsive processing certain MBOX files.

SYMPTOMS

CAUSE

There are scenarios where 2 email servers could continuously volley an undeliverable email back and forth. Reciprocating bounced emails consumes all resources as conversation becomes longer.

RESOLUTION

These reciprocating bounced emails likely do not contain responsive information and processing of them needs to be modified.
The following are the instructions on how to build a signature for the mime detector to categorize bounced EML files so they can be processed separately. This example is based on a text search in first 8Kb of an EML file and for demonstration purposes only. (Hex string used will vary on a case-by-case basis.)
“----- The following addresses had permanent fatal errors -----” string was used to set a specific mime for a document (message/rfc822.bounces).

A. To build the signature for identifying the emails, use Excel and populate the cells as instructed in the following steps:

1. Using a hex editor, record the hexidecimal data for a unique string that is common to all of the emails.
2. Populate cell A1 with the hex value. (Ex. 2D2D2D2D2D2054686520666F6C6C6F77696E672061646472657373657320686164207065726D616E656E7420666174616C206572726F7273202D2D2D2D)
3. Populate cell A2 with: =LEN(A1)/2
4. Populate column A from cell A4 down for as many cells as are required to account for the entire hex string in cell A1 with the following string:
=MID($A$1,(ROW()-3)*2 -1,2)
5. Populate column B from cell B4 down with the following text for as many cells as there is data displayed in column A:
=CONCATENATE("<Shift Byte='",A4, "'>", $A$2 + 4 -ROW(),"</Shift>")

note: column referenced for Shift Byte is relative to the row that the calculation is on. (Ex. if in cell B6 then, Shift Byte='",A6),
6. The displayed values in Column B from B4 down will be used in one of the following steps.

B. Edit the following files:

1. In ZyLAB\LegalProcessing\ProcessingService\MimeDetectors\ZyLAB.Mime.Droid.ZyLABAdditions.xml add new InternalSignature to InternalSignaruteCollection.

a. Assign unique ID.
b. Put byte representation of a string you are looking for into <Sequence> element.
c. To build the signature for identifying the emails, follow these steps, use Excel and populate the cells as instructed in the following Steps.
- populate cell A1 with the hex value of a string unique to the emails.
d. Add proper <Shift Byte=''> elements (Use the signature built in Step A above.).

2. In the same file, add a new <FileFormat> to <FileFormatCollection>

a. Assign unique ID.
b. User Signature ID from step 1. (Note: In case you want to use several signatures for new mime type – add InternalSignatureId elements here.)
c. Set priority over original message/rfc22 (should be 11002)
d. Assign your name for new mime type

.....

</FileFormat>
<FileFormat ID="11003" Name="Internet Message Format Bounces" MIMEType="message/rfc822.bounces">
<InternalSignatureID>1014</InternalSignatureID>
<Extension>eml</Extension>
<HasPriorityOverFileFormatID>11002</HasPriorityOverFileFormatID>
</FileFormat>
</FileFormatCollection>

3. The following needs to be added to the KnowMimeType.xml file in the '\Program Files (x86)\ZyLAB\EDiscovery\Ediscoveryservice' folder:

4. In your processing rules, add a new mime type as was referenced in the new <FileFormatCollection> that was added in Step 2 and set it to be indexed (do nothing if you want to ignore such docs):

5. Restart the Processing Service.

APPLIES TO

3.9

Articles in this section

Comments

Articles in this section

Related articles