Forefront TMG Email Test

Network administrators are constantly worried about blocking malware in e-mail and making sure that mail servers don't get flooded by spam. The Microsoft Threat Management Gateway is not only capable of removing dangerous messages and junk, but can also block threatening traffic before delivering it to the mail server. This can be achieved when the Exchange Edge Server and Forefront for Exchange are both installed on the TMG Server, thus making the TMG a truly effective e-mail gateway. Combined with Edge Server and Forefront for Exchange, TMG uses multiple anti-virus engines to scan all e-mails for viruses. When a remote computer tries to establish a connection, a new, reputation-based blacklist feature can block incoming spam before any data is sent to the e-mail server. TMG compares incoming messages against a frequently updated list of spam signatures when looking to block incoming spam messages.

It is evident therefore that the true test of the effectiveness of TMG lies not just in the quantity of messages it scans for viruses, but also the quality of messages it finally delivers to the mail server. If too many infected / spam messages find their way to the mail server, it signifies poor TMG performance! This is why, administrators need to keep a close watch on the number of messages the TMG scans and the number of messages it tags as infected or as spam. To perform this check periodically and understand the level of protection the TMG imparts to their critical email servers, administrators can use the Forefront TMG Email test.

This test monitors the Forefront TMG and reports the number of email messages that were scanned for malicious content, the number of messages that were blocked for the malicious content present in it and the number of messages that were categorized as spam.

Target of the test : A Forefront TMG Server

Agent deploying the test : An internal agent

Outputs of the test : One set of results for the Forefront TMG that is to be monitored.

Configurable parameters for the test

Parameter	Description
Test Period	How often should the test be executed.
Host	The IP address of the host for which this test is to be configured.
Port	The port at which the specified host listens to. By default, this is 1745.
IsPassive	If this parameter is set to Yes, then it means that, by default, all the Forefront TMG servers being monitored by the eG system are the passive servers of a Forefront TMG cluster. No alerts will be generated if the servers are not running. Measures will be reported as “Not applicable” by the agent if the servers are not up.

 

Measurements made by the test

Measurement	Description	Measurement Unit	Interpretation
Scanned messages	Indicates the total number of email messages that were scanned/inspected for malicious content by the Forefront TMG during the last 24 hours.	Number	A low value for this measure could indicate either of the following: A processing bottleneck with the TMG that compels it to take too long to scan messages, resulting in a small number of scanned messages at the end of the day; Many large messages were scanned by TMG during that day;
Infected messages	Indicates the total number of infected email messages that were blocked by the Forefront TMG during the last 24 hours.	Number	If the value of this measure is close to the value of the Scanned messages measure, it indicates that most of messages to the email server during that day were infected. This could indicate a major virus outbreak, which needs to be immediately investigated.
Spam messages	Indicates the total number of email messages that were categorized as spam by the Forefront TMG during the last 24 hours.	Number	If the value of this measure is abnormally high, it could be because many valid messages have been wrongly categorized as spam. You may then have to fine-tune TMG to avoid such mishaps.