No AgentLog folder in the FrontEnd folder

Question

Hello!

According to this article there should be two AgentLog folders after enabling antispam on mailbox servers:

Nevertheless, only one folder is created - in the Hub folder:

The FrontEnd folder still misses the AgentLog folder although I do see - for example -the messages in the FronEnd\SmtpReceive logs (in other words there are messages that come through Default FrontEnd connector):

???

Thank you in advance,
Michael

Answer 1

Hi @Mikhail Firsov

This article introduces more information: Configuring Anti-Spam Protection on Exchange 2013, 2016 – RBL Providers
Please Note: Since the web site is not hosted by Microsoft, the link may change without notice. Microsoft does not guarantee the accuracy of this information.

And in Exchange 2013, the transport role is divided into two components: Front End Transport and Back End Transport, and the anti-spam filtering feature is divided into two parts. The Front End server performs Connection Filtering and the Back End server does the Content Filtering (including the IMF filter – Exchange Intelligent Message Filter and the virus-detecting agent – Malware Agent).

All roles (except for Edge Transport) are merged in Exchange 2016, and Exchange 2016 has all these transport role services as well

And this article also indicates the steps to enable the agent you installed and restart the Front End Transport service.

---

If an Answer is helpful, please click "Accept Answer" and upvote it.

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Answer 2

Hi @Mikhail Firsov

According to the pictures you shared above, you might have installed the AntiSpamAgents in your environment, so the agentlog in hub folder is created correctly.
Enable antispam functionality on Mailbox servers

For the same folder in front end, we may need to Install-TransportAgent for frontend as well, you could refer to the steps list in this related article: RBL and Exchange 2013

And here is a thread discussed the issue: Connection Filtering agent doesn't work for your reference as well

---

If an Answer is helpful, please click "Accept Answer" and upvote it.

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Answer 3

Hi joyceshen-MSFT,

It appears to be nonsense to me: there's the article that states that procedures described in it (specifically in the Configure Antispam Agent Logging) should lead to the TWO AgentLogs folder if the you follow this:

Agent logging
Agent logging records the actions that are performed on messages by specific antispam transport agents on the Exchange server. For more information, see these topics:
Antispam Agent Logging
Configure Antispam Agent Logging
Enable antispam functionality on Mailbox servers
Enabled by default?: Yes
Default location of log files: Note that the folder isn't created until an agent attempts to write information to the log.
Mailbox servers:

Front End Transport service: %ExchangeInstallPath%TransportRoles\Logs\FrontEnd\AgentLog
Transport service: %ExchangeInstallPath%TransportRoles\Logs\Hub\AgentLog

Transport service on Edge Transport servers: %ExchangeInstallPath%TransportRoles\Logs\Edge\AgentLog

Furthermore, no documentation I've read so far indicates the some additional steps like "Install-TransportAgent -Name "Connection Filtering Agent" -TransportService" must be taken - it looks like a workaround instead. By the way, as far as I see MS documentation does not contain the article titled ~ Antispam on CAS:

Anyway, I do see that once the steps described here are taken no agents are applied to the FrontEnd service:

1) prior to & $env:ExchangeInstallPath\Scripts\Install-AntiSpamAgents.ps1

2) after:

Having that said I think either this is a bug or this documentation is wrong and MS even doesn't plan on using antispam filtering on FrontEnds and this is the most weird thing: should I be supposed to allow all incoming spam through the Front End just to reject it on the Back End? What's the purpose???

Answer 4

Hi joyceshen-MSFT,

Yes, this is the answer:

"In Exchange 2013, if the CAS and Mailbox roles are installed on the same server, the Install-AntispamAgents.ps1 script installs only the Content Filtering agent. It means that the RBL filtering won’t be available."

...and my surmise proved correct: the article is wrong saying AgentLog folder to be created in both locations (FronEnd and Hub).

Thank you for the help!

Regard,
Michael