Information about the Sniffer Lock feature in Outlook

Support for Office 2003 has ended

Microsoft ended support for Office 2003 on April 8, 2014. This change has affected your software updates and security options. Learn what this means for you and how to stay protected.

Summary
Outlook has a feature, nicknamed the "sniffer", that automatically processes certain types of messages that are sent to you or received by your delegate. The sniffer can process items such as voting responses, read receipts, message recall notices, as well as meeting invites and meeting responses. The latter two items are most relevant in a manager-delegate scenario, and in this scenario Outlook will only process these items (intended for the manager) on either the manager's machine or the delegate's machine, not both. 

To control which machine processes an item in a manager-delegate scenario, the sniffer feature has a component called "sniffer lock", and in simple terms, the sniffer lock is a hidden value stored in your mailbox that contains the name of the computer that currently owns the sniffer lock for your mailbox. The sniffer lock also has a time stamp on it so Outlook can determine the age of the value (explained in more detail later in this article). So, when the sniffer process runs on your computer, it first checks the value of the sniffer lock to determine whether or not to process an item for your mailbox. If the sniffer lock value references another computer, you may not see items processed as quickly as they would in a scenario that does not include a delegate. 

NOTE: If you have a mailbox on Exchange 2007 or later, the default Exchange Calendar Assistant configuration processes meeting invites, updates, and responses when they arrive in your Inbox. They are only processed by sniffer if you have the Calendar Assistant disabled on your mailbox (not a recommended configuration). So, the above described nuance of the sniffer lock should have no impact on you when your mailbox is on Exchange 2007 or later.
More information
The following steps summarize the processs flow used by Outlook (on a delegate's client in this example) to determine and configure the sniffer lock value for a mailbox in a manager-delegate scenario.

  1. During idle time, the sniffer process starts on your running Outlook client.
  2. The sniffer starts to process a message that you received on behalf of your manager.
  3. Outlook checks the age of the sniffer lock value stored in the manager's mailbox.
    1. If the sniffer lock age is over 60 minutes, the value of the sniffer lock is changed to your computer's name, and the sniffer process on your client will process the item on behalf of your manager.
    2. If the sniffer lock age is less than 60 minutes, the value of the sniffer lock is unchanged. 
      • If the sniffer lock references your computer, then the item is processed by sniffer on your computer.
      • If the sniffer lock references your manager's computer, then the item is Not processed by sniffer on your computer.
  4. This process is repeated each time the sniffer process starts.

The following is a more detailed example of how the sniffer lock may cause slower processing of items than expected. 

Note, this scenario is mostly aimed at an environment with Exchange 2003, but it can also apply to later versions of Exchange if the calendar assistant is disabled for the manager's mailbox.

  1. A manager is currently configured with a delegate.
  2. The delegate configuration has meeting invites and responses going to both the manager and the delegate.
  3. Outlook is not running on either the manager's machine or the delegate's machine. They were both exited at 6:00 pm the night before.

    For the sake of this example, the sniffer lock value in the manager's mailbox references the manager's computer.
  4. The next morning at 9:00 am, a meeting invite is sent to the manager by someone else in the organization.
  5. The delegate then starts Outlook at 9:15 am, and the manager's Outlook client is still not running.
  6. The Outlook sniffer process on the the delegate's client checks the hidden sniffer lock value in the manager's mailbox and sees that it is over 60 minutes old and that it is currently referencing the manager's computer.
  7. The Outlook sniffer process changes the sniffer lock value stored in the manager's mailbox to reference the delegate's computer name.
  8. The Outlook sniffer processes the meeting invite on behalf of the manager.
  9. The delegate then shuts down Outlook at 9:30 am.
  10. At 9:33 am, another meeting invite is sent to the manager

    Both Outlook clients are shut down so there is no processing done on this invite at this time. The delegate's client stays shut down for the remainder of this example.
  11. The manager starts Outlook at 9:40 am.
  12. During the first idle time, the sniffer process on the manager's client starts and checks the age of the sniffer lock stored in the manager's mailbox.

    The age of the sniffer lock is less than 60 minutes, so the sniffer lock value is left unchanged from the delegate's computer name.
  13. Because the sniffer lock points to the delegate's computer, the sniffer process on the manager's machine does not process the meeting invite.
  14. The manger's Outlook client is left running and at 10:15 am another meeting invite is sent to the manager.
  15. During the next idle tiem, the sniffer process on the manager's client starts and checks the age of the sniffer lock stored in the manager's mailbox.

    At this point in time, the sniffer lock age is more than 60 minutes, so the sniffer lock value is changed to the manager's computer name.
  16. The meeting invite that was first received at 9:33 am is finally processed by the manager's Outlook client because the sniffer lock is now referencing the manager's computer name.
TIP:

The following command-line switch for Outlook.exe can be used to force Outlook to reset the sniffer lock value to the computer on which the switch is used. It is most commonly used in manager-delegate scenarios, but it can also be used in situations where a user has more than one Outlook client.

/cleansniff

In the above example, if the manager had started Outlook in step 11 using the /cleansniff switch, the sniffer lock would have been changed to the manager's computer in step 12 even though the age of the sniffer lock was less than 60 minutes at that point.
Note This is a "FAST PUBLISH" article created directly from within the Microsoft support organization. The information contained herein is provided as-is in response to emerging issues. As a result of the speed in making it available, the materials may include typographical errors and may be revised at any time without notice. See Terms of Use for other considerations.
Properties

Article ID: 2699728 - Last Review: 12/08/2015 05:33:00 - Revision: 3.0

Outlook 2016, Microsoft Outlook 2013, Microsoft Outlook 2010, Microsoft Office Outlook 2007, Microsoft Office Outlook 2003

  • KB2699728
Feedback