Tuesday, 12 June 2007

The Outlook Inbox Sniffer

There's not much information around on the web about the Sniffer, but I was lucky enough to get hold of some pretty good documentation last year that covers how it works. Outlook's Inbox Sniffer is a piece of built-in code that keeps an eye on your Inbox for items of a certain type, and performs certain actions for you. The complete list is as follows:
  • Meeting invites (adding tentative meetings to your calendar)
  • Meeting updates (updating details in your calendar)
  • Task updates
  • Message recall (when someone recalls a message you've received)
  • Responses to voting buttons (when you sent a mail with voting buttons, this adds the voting responses back to the original item)

This applies to Outlook versions from 2000 onwards. The results are slightly different in Outlook 2007 (e.g. the way meeting updates are processed) but - as far as I know - the mechanism is the same.

The Sniffer runs as a MAPI idle process. This means it starts processing when the messaging system that underlies Outlook isn't otherwise busy. This doesn't necessarily correspond to whether the Outlook application is busy though. You could be typing an email message and the Sniffer would still fire, whereas it won't fire if mail is downloading from a server, even though you're not 'using' Outlook at the time. This is why sometimes invites appear to show up as tentative Calendar entries almost straight away, and sometimes they take a little longer.

So far so good... but what do you do if the Sniffer isn't working?

(This bit bit contains technical advice, so my usual disclaimer applies.)

  • First, is the actionable item actually in the Inbox? If, say, a meeting invite got moved to a folder by a rule then it may have left the Inbox before the Sniffer got to it. If the rule is client-side then you could get a Rule vs. Sniffer race occurring.

  • Next, have you told Outlook not to process some item types? The settings Process requests and responses on arrival and Process receipts on arrival need to be selected (Tools > Options > Email options > Tracking Options) for those actions to take place.

  • Is this machine able to run the Sniffer against this mailbox? To deal with users running Outlook on more than one machine with the same mailbox, a mechanism was put in place where only one can be the Sniffer at a time (the Sniff Owner). Run Outlook with the /sniff switch to set it as the Sniff Owner, or /cleansniff to delete and recreate the Sniff Owner information.
  • Is there any idle time? An add-in or another application calling Outlook could be keeping MAPI busy (or making it think it's busy). Try closing down any applications that may interact with Outlook, e.g. synchronisation tools, and waiting at least five minutes before checking if items have been processed. If that didn't isolate the problem, try disabling any add-ins you have loaded in Outlook, wait five minutes and check again.
  • Is thre a long idle time specified in the registry? Under the key HKEY_Current_User/Software/Microsoft/Office/11.0/Outlook/Options/General check for these values
    • AutoProcessIdleTime - this is how much idle time is required before the Sniffer will act
    • AutoProcessIdleTimeMax - this is how long the Sniffer waits before trying again if MAPI was not idle on the previous attempt
  • Both the values are specified in milliseconds (so a value of 10000 is 10 seconds). If these don't exist in the registry then the defaults are used, 30 seconds and 600 seconds respectively. Setting a lower value for both would cause the Sniffer to run more frequently, but there would be an associated performance hit on the rest of Outlook. Setting the value very low would cause the Sniffer to run almost continuously, taking up system resources that could be used for other tasks.
  • Is another application or add-in marking the items as 'sniffed'? This is the least likely scenario but theoretically could happen. To test for this you would need to look at the message properties of the Inbox item using a tool such as MDBVU or MFCMAPI. If the PR_PROCESSED property is set to TRUE then the Sniffer will not act on this item again because it thinks it has already done so. (If the property doesn't exist or is set to FALSE then the message has not been marked as sniffed.)

That covers just about everything I know about the Sniffer - I hope this post has been useful to someone out there!



  1. Thanks very much! I am hoping that this will solve some issues that I am experiencing with our clients.


  2. Thank you for this amazing Post - Excellent

  3. This is great. Thanks for much for posting something about the sniffer because you're right, there's hardly anything about it on the web. :)

  4. I have just started using Outlook2003. I have seen the sniffer feature with meeting requests - my problem is when I accept the meeting request via the Inbox, Outlook adds a duplicate meeting request. In other words, the original tentative meeting request is there, along with the one I accepted. Any ideas how to stop this duplication?

  5. Regarding the duplicate appointments... you may have something interacting with your calendar that doesn't work well with the changes described in http://support.microsoft.com/kb/899919. If you have a Blackberry, see http://www.blackberryforums.com/bes-admin-corner/25038-appointments-randomly-missing.html#post166125 for a possible answer. If you're synchronising with some other device or program, try breaking the relationship and see if the problem still occurs. Finally, try running Outlook in Safe mode - see if the problem occurs with all the addins switched off, that may help you narrow things down. Although http://www.outlookpower.com/issues/issue200411/00001431001.html doesn't relate directly to your problem it includes information on how to kill addins individually, even those that don't show up in the add in manager, so also look there!

  6. indeed, a very clear article and the only one we could find on the net that solved our problem.

    Thanks a lot

  7. I'm also very pleased with this document but not so pleased with the fact that the sniffer only works when Outlook is active.
    When employees are out of the office no tentative appointments are made and as e result sometimes double appointments are planned.
    Do you know of a 'sniffer' that runs without Outlook being active

    Thanks in advance,

  8. Thank you very much. I had to create the registry keys and a combination of "delegate alteration", starting with /cleansniff and /sniff and the registry keys has solved this issue for me.

    Super happy - as it keeps the ultimate boss of the company happy.

  9. I have a variation on this that I haven't seen online yet. I'm using Outlook 2003. Recently I noticed that a lot of my meeting notices are not showing up on my calendar at all until I accept them. (The sniffer is not putting them on the calendar as tentative.) I asked around the office and found out that other 2003 users have been having the same problem. We realized that the problem seems to occur when the meeting organizer is an Outlook 2007 user and the recipient is a 2003 user. (Outlook 2007 is being phased in at my company.) We'll see if the problem goes away once we are all upgraded to 2007.

  10. Oh have mercy...this just may be the answer I've been looking for. Thanks for the great knowledge!

  11. ThankyouThankyouThankyouThankyouThankyouThankyouThankyouThankyouThankyouThankyouThankyouThankyouThankyouThankyouThankyouThankyouThankyouThankyouThankyouThankyouThankyouThankyouThankyouThankyouThankyouThankyouThankyouThankyouThankyouThankyou! Really. This issue is starting to rear it's ugly head with heavy users of Outlook 2007 and Office Communicator 2007 R2. MAPI ust likes to get all locked up.

    Again... a bajillion thank yous.

  12. Many thanks, great post.

  13. I had an issue where the invites weren't appearing as tentative on the calender. I used several steps you documented to no avail. I used OWA to access the mailbox and found the same issue with the OL client closed. Within OWA I saw the calendar setting was checked to place meeting invites on my calendar and mark as tentative. I unchecked it, saved it, re-enabled the setting and the new invites did indeed show on the calendar as tentative.I then re-tested with OL open and they continued to appear on the calendar.
    Odd, but it worked.

    Thanks for the info, though. I learned something new today :)

  14. How do I get this to be server based? I need items to show up in the user's calendar as 'tentative' as soon as they get it (i.e. before they open or accept it). I have a secretary who sends invites to a LOT of people, and has full access to their Calendars but cannot see these items until that person opens/accepts it. the server is Exchange 2003, and clients are 2007. In 2003, Outlook web access (OWA) did not have the calendar options that are mentioned in the above comment. What do I do? Please post the answer here (I have bookmarked this page and will check it often).


Creative Commons License This work by TechieBird is licensed under a Creative Commons Attribution-No Derivative Works 2.0 UK: England & Wales License.