SYMPTOMS
Processing nodes use all available memory and become unresponsive processing certain MBOX files.
CAUSE
There are scenarios where 2 email servers could continuously volley an undeliverable email back and forth. Reciprocating bounced emails consumes all resources as conversation becomes longer.
RESOLUTION
These reciprocating bounced emails likely do not contain responsive information and processing of them needs to be modified.
The following are the instructions on how to build a signature for the mime detector to categorize bounced EML files so they can be processed separately. This example is based on a text search in first 8Kb of an EML file and for demonstration purposes only. (Hex string used will vary on a case-by-case basis.)
“----- The following addresses had permanent fatal errors -----” string was used to set a specific mime for a document (message/rfc822.bounces).
A. To build the signature for identifying the emails, use Excel and populate the cells as instructed in the following steps:
2. Populate cell A1 with the hex value. (Ex. 2D2D2D2D2D2054686520666F6C6C6F77696E672061646472657373657320686164207065726D616E656E7420666174616C206572726F7273202D2D2D2D)
3. Populate cell A2 with: =LEN(A1)/2
4. Populate column A from cell A4 down for as many cells as are required to account for the entire hex string in cell A1 with the following string:
=MID($A$1,(ROW()-3)*2 -1,2)
5. Populate column B from cell B4 down with the following text for as many cells as there is data displayed in column A:
=CONCATENATE("<Shift Byte='",A4, "'>", $A$2 + 4 -ROW(),"</Shift>")
note: column referenced for Shift Byte is relative to the row that the calculation is on. (Ex. if in cell B6 then, Shift Byte='",A6),
6. The displayed values in Column B from B4 down will be used in one of the following steps.
B. Edit the following files:
b. Put byte representation of a string you are looking for into <Sequence> element.
c. To build the signature for identifying the emails, follow these steps, use Excel and populate the cells as instructed in the following Steps.
- populate cell A1 with the hex value of a string unique to the emails.
d. Add proper <Shift Byte=''> elements (Use the signature built in Step A above.).
<InternalSignature ID="1014" Specificity="Specific">
<ByteSequence>
<SubSequence MinFragLength="0" Position="1" SubSeqMaxOffset="0" SubSeqMinOffset="0">
<!-- [5 hyphens]The following addresses had permanent fatal errors[5 hyphens] -->
<Sequence>2D2D2D2D2D2054686520666F6C6C6F77696E672061646472657373657320686164207065726D616E656E7420666174616C206572726F7273202D2D2D2D</Sequence>
<DefaultShift>2</DefaultShift>
<Shift Byte='2D'>61</Shift>
<Shift Byte='2D'>60</Shift>
…
<Shift Byte='2D'>2</Shift>
<Shift Byte='2D'>1</Shift>
</SubSequence>
</ByteSequence>
</InternalSignature>
b. User Signature ID from step 1. (Note: In case you want to use several signatures for new mime type – add InternalSignatureId elements here.)
c. Set priority over original message/rfc22 (should be 11002)
d. Assign your name for new mime type
<FileFormat ID="11002" Name="Internet Message Format" MIMEType="message/rfc822">
<FileFormat ID="11003" Name="Internet Message Format Bounces" MIMEType="message/rfc822.bounces">
<InternalSignatureID>1014</InternalSignatureID>
<Extension>eml</Extension>
<HasPriorityOverFileFormatID>11002</HasPriorityOverFileFormatID>
</FileFormat>
</FileFormatCollection>
3. The following needs to be added to the KnowMimeType.xml file in the '\Program Files (x86)\ZyLAB\EDiscovery\Ediscoveryservice' folder:
<DocumentPattern PatternType="MimeType" PatternText="message/rfc822.bounces" />
</DocumentProcessingStepPattern>
APPLIES TO
3.9
Comments
0 comments
Article is closed for comments.