| Event Id | 17220 |
| Source | SmtpEvt |
| Description | An unknown SMTP command |
| Event Information | According to Microsoft: CAUSE: After the ISA Server SMTP filter is updated by ISA Server 2000 SP1, event ID 17220 and 17240 are changed to 20031 and 20033. Because of this, you cannot correctly view the 17220 and 17240 events in the Application Log after you apply ISA Server 2000 SP1. Instead, you receive a "The description for Event ID (x) in Source (Y) cannot be found" message. This message is logged when the SMTP Filter service in ISA Server receives a command that is not listed under the SMTP Commands tab in the SMTP Filter properties. The command that was passed appears in the DATA section of the event message. If the command was expected, you must add this command to the SMTP Filter properties SMTP Commands tab. This message is logged when the SMTP Filter service in ISA Server receives a command that is longer than the permitted length that is listed under the SMTP Commands tab in the SMTP Filter properties. The command that was passed appears in the DATA section of the event message. If the command was expected, you must modify the permitted length of this command in the SMTP Filter properties SMTP Commands tab. To resolve this issue, add the appropriate SMTP command in the application filter. Or, you can disable SMTP content filtering if it is not necessary. |
| Reference Links | SMTPEVT 20031 or 20033 Entries in the Application Log After You Apply ISA Server SP1 |
Catch threats immediately
We work side-by-side with you to rapidly detect cyberthreats
and thwart attacks before they cause damage.