ORF service is running andblocking 25 port RSS Back to forum
@alexey.tsonya:
judging from the information provided, the problem is with Exchange, affecting (but not caused by) ORF.
ORF has no effect on port 25 whatsoever, as it does not relay any emails on its own. It is an add-on for Exchange: ORF installs two Exchange Transport Agents to establish communication between Exchange and the ORF Service. Through these Transport Agents, Exchange passes on information about incoming emails (not the emails themselves) to the ORF Service. The ORF Service performs its tests and if the email fails on any of its blacklists tests, it instructs the Exchange server to reject the email during SMTP Transport. If it passes all blacklists tests or the email is whitelisted (excluded from filtering), ORF sits idle.
I recommend checking the Application log using the Event Viewer in Windows to see if any errors were logged when the problem started (i.e., what caused the ORF Service to stuck in a "stopping" stage). I'd also check the status of the Exchange/SMTP services, and checking the ORF logs for any errors.
Hello,
I analized logs from exchange server, and from ORF. I find warnings in Exchange log like this "Runtime agent 'Vamsoft ORF SMTP Receive Agent' while processing the event 'OnEndOfData' exceeded 90,000 ms for a message with the identifier InternetMessageId: '<d9b301d01a6e $ 6c2652c0 $ d82234bd @ ttkobjavvh>'. This is an unusually large amount of time to process one event agent. Nevertheless transport will continue to process the message." and I have system message in ORF log like this
-------------------------------------------------------------------------------
-- EVENT SUMMARY --
Time: 18.12.2014 5:05:14 GMT+0300 RTZ 2 (зима)
Sender Email: (not available)
Recipient Email: (not available)
Related IP: (not available)
Action: (not available)
Email Subject: (not available)
-- EVENT MESSAGE --
ORF Service is starting...
-- EVENT DETAILS --
Filtering Point: Non-filtering
Event Class: System Message
Severity: Information
Server: RNC10.yukoscard.ru
Event Source: (not available)
HELO Domain: (not available)
Message ID: (not available)
Log Mode: Verbose
ORF Version: 5.3 REGISTERED
-------------------------------------------------------------------------------
ORF Service is started and ready.
@Alexey Tsonya:
The error message means ORF was unable to complete its test on the email within 1.5 minutes at the On Arrival filtering point (OnEndOfData), so it gave up and let it through.
Not sure what causes this, but if you have Tarpit Delay enabled in ORF by any chance, I recommend disabling it:
1. Start the ORF Administration Tool and connect to the local or remote ORF instance
2. Navigate to Filtering / Actions
3. Click Edit under Before Arrival, make sure "Enable Tarpit Delay" in unchecked, click OK
4. Click Edit under On Arrival, make sure "Enable Tarpit Delay" in unchecked, click OK
5. Save the configuration to apply the changes
Hello!
I've got problem with the ORF.
The first step of problem - 25 port is no answering, people can't send e-mail. In this moment I can't connect to the ORf with local or remote console.
The second step - when I reststart ORF service, service is going to state 'stopping' and I have a message about 'service is no answering'. Then I kill process ORFeesvc.exe and start service.
In this step problem is solved? and Exchange server works fine about 24 hours, then problem repeats.
What can I do to resolve this problem?