No AgentLog folder in the FrontEnd folder

Mikhail Firsov 1,876 Reputation points
2022-03-03T15:07:40.997+00:00

Hello!

According to this article there should be two AgentLog folders after enabling antispam on mailbox servers:
179714-02.png

Nevertheless, only one folder is created - in the Hub folder:
179761-00.png

The FrontEnd folder still misses the AgentLog folder although I do see - for example -the messages in the FronEnd\SmtpReceive logs (in other words there are messages that come through Default FrontEnd connector):
179762-01.png

???

Thank you in advance,
Michael

Exchange Server Management
Exchange Server Management
Exchange Server: A family of Microsoft client/server messaging and collaboration software.Management: The act or process of organizing, handling, directing or controlling something.
7,379 questions
0 comments No comments
{count} votes

Accepted answer
  1. Joyce Shen - MSFT 16,646 Reputation points
    2022-03-08T05:38:53.22+00:00

    Hi @Mikhail Firsov

    This article introduces more information: Configuring Anti-Spam Protection on Exchange 2013, 2016 – RBL Providers
    Please Note: Since the web site is not hosted by Microsoft, the link may change without notice. Microsoft does not guarantee the accuracy of this information.

    180876-image.png

    And in Exchange 2013, the transport role is divided into two components: Front End Transport and Back End Transport, and the anti-spam filtering feature is divided into two parts. The Front End server performs Connection Filtering and the Back End server does the Content Filtering (including the IMF filter – Exchange Intelligent Message Filter and the virus-detecting agent – Malware Agent).

    All roles (except for Edge Transport) are merged in Exchange 2016, and Exchange 2016 has all these transport role services as well
    180837-image.png

    And this article also indicates the steps to enable the agent you installed and restart the Front End Transport service.


    If an Answer is helpful, please click "Accept Answer" and upvote it.

    Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

    0 comments No comments

3 additional answers

Sort by: Most helpful
  1. Joyce Shen - MSFT 16,646 Reputation points
    2022-03-04T02:31:13.273+00:00

    Hi @Mikhail Firsov

    According to the pictures you shared above, you might have installed the AntiSpamAgents in your environment, so the agentlog in hub folder is created correctly.
    Enable antispam functionality on Mailbox servers

    For the same folder in front end, we may need to Install-TransportAgent for frontend as well, you could refer to the steps list in this related article: RBL and Exchange 2013
    179858-image.png

    And here is a thread discussed the issue: Connection Filtering agent doesn't work for your reference as well


    If an Answer is helpful, please click "Accept Answer" and upvote it.

    Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

    0 comments No comments

  2. Mikhail Firsov 1,876 Reputation points
    2022-03-04T12:28:10.423+00:00

    Hi joyceshen-MSFT,

    It appears to be nonsense to me: there's the article that states that procedures described in it (specifically in the Configure Antispam Agent Logging) should lead to the TWO AgentLogs folder if the you follow this:

    Agent logging
    Agent logging records the actions that are performed on messages by specific antispam transport agents on the Exchange server. For more information, see these topics:
    Antispam Agent Logging
    Configure Antispam Agent Logging
    Enable antispam functionality on Mailbox servers
    Enabled by default?: Yes
    Default location of log files: Note that the folder isn't created until an agent attempts to write information to the log.
    Mailbox servers:

    Front End Transport service: %ExchangeInstallPath%TransportRoles\Logs\FrontEnd\AgentLog
    Transport service: %ExchangeInstallPath%TransportRoles\Logs\Hub\AgentLog

    Transport service on Edge Transport servers: %ExchangeInstallPath%TransportRoles\Logs\Edge\AgentLog

    Furthermore, no documentation I've read so far indicates the some additional steps like "Install-TransportAgent -Name "Connection Filtering Agent" -TransportService" must be taken - it looks like a workaround instead. By the way, as far as I see MS documentation does not contain the article titled ~ Antispam on CAS:
    180089-07.png

    Anyway, I do see that once the steps described here are taken no agents are applied to the FrontEnd service:

    1) prior to & $env:ExchangeInstallPath\Scripts\Install-AntiSpamAgents.ps1
    180090-06-beforeantispam.png

    2) after:
    180099-05-after.png

    Having that said I think either this is a bug or this documentation is wrong and MS even doesn't plan on using antispam filtering on FrontEnds and this is the most weird thing: should I be supposed to allow all incoming spam through the Front End just to reject it on the Back End? What's the purpose???

    0 comments No comments

  3. Mikhail Firsov 1,876 Reputation points
    2022-03-09T08:26:31.203+00:00

    Hi joyceshen-MSFT,

    Yes, this is the answer:

    "In Exchange 2013, if the CAS and Mailbox roles are installed on the same server, the Install-AntispamAgents.ps1 script installs only the Content Filtering agent. It means that the RBL filtering won’t be available."

    ...and my surmise proved correct: the article is wrong saying AgentLog folder to be created in both locations (FronEnd and Hub).

    Thank you for the help!

    Regard,
    Michael

    0 comments No comments