Topic Last Modified: 2006-10-06

The Microsoft® Exchange Server Analyzer Tool queries the Win32_NTLogEvent Microsoft Windows® Management Instrumentation (WMI) class to determine whether an Event 6008 warning has been logged for MSExchangeTransport within the last 24 hours.

If the Exchange Server Analyzer finds that an Event 6008 warning has been logged for MSExchangeTransport within the last 24 hours, the Exchange Server Analyzer displays a warning.

This warning indicates that the categorizer encountered an error when it tried to process a message.

The message categorizer examines messages that come to a Simple Mail Transfer Protocol (SMTP) server and determines what to do with the messages. The messages may be destined for the local information store, for a remote host by using the message transfer agent (MTA), or for a remote host by using SMTP. The categorizer also handles distribution list expansion. The categorizer is a plug-in to the advanced queuing engine that performs Lightweight Directory Access Protocol (LDAP) queries against global catalog servers on TCP port 3268. The categorizer is basically a collection of event sinks that perform advanced address resolution on every message that travels through the advanced queuing engine. The categorizer performs address resolution and mail forwarding, sets content conversion flags, expands distribution lists, enforces global settings, and generates delivery status notifications. The categorizer also detects alternative recipient routes and performs bifurcation, journaling, and many other functions.

As soon as a message enters the message categorizer, the categorizer resolves the envelope sender by searching for the address in the proxy address attributes in the Active Directory® directory service. The categorizer also resolves the envelope recipient by searching for each address in the proxy addresses attribute in Active Directory. For example, if the list includes a distribution list, it expands the list to include those members if distribution list expansion is allowed on the server.

Possible causes of MSExchangeTransport Warning event 6008 include the following:

To address this warning:

For more information about Exchange Server 2003 events and errors, see the "Events and Errors Message Center" (http://go.microsoft.com/fwlink/?LinkId=34258).

For a listing of the DSNs and NDRs generated by Exchange Server and Microsoft Windows Small Business Server, see Microsoft Knowledge Base article 284204, "Delivery status notifications in Exchange Server and in Small Business Server" (http://go.microsoft.com/fwlink/?linkid=3052&kbid=284204).

For information about how to use the Message Tracking Center in Exchange Server, see the following Microsoft Knowledge Base articles:

For more information about how to troubleshoot message categorizer issues, see the Microsoft Support WebCast, "Exchange 2000 Server: Message Categorizer and NDR Troubleshooting" (http://go.microsoft.com/fwlink/?linkid=3052&kbid=329137).

For more information about the Archive Sink tool, see Microsoft Knowledge Base article 307798, "The Archive Sink utility is available in Service Pack 2" (http://go.microsoft.com/fwlink/?linkid=3052&kbid=307798).

For more information about non-hierarchal restriction checking, see Consider non-hierarchical restriction checking.

For more information about the effect of distribution group restriction on Exchange Server mail flow, see the following Microsoft Knowledge Base articles:

For general information about how to troubleshoot transport-related problems, see the following Microsoft Knowledge Base articles and resources:

The message categorizer performance counters are published separately for each SMTP virtual server instance. For a list of the available performance counters related to the message categorizer, see Microsoft Knowledge Base article 231734, "XCON: Performance Monitor Counters for Message Categorizer" (http://go.microsoft.com/fwlink/?linkid=3052&kbid=231734).