losing e-mails? RSS Back to forum
I tried the exchange message tracking troubleshooter and it only finds the mails that actually arrived - not the first two I sent that I only see before arrival logs as mentioned above.
@jhoff:
ORF examines the email transmission at two stages of the SMTP Transport, after the RCPT TO: command has been issued by the sender server (Before Arrival filtering point) and at the end of the DATA/BDAT stage, when the entire email has been transferred (On Arrival filtering point).
The fact that there are no On Arrival entries in the log indicates the SMTP transmission was terminated in between the two stages: it could have been done by either the sender server or yours.
Are the ORF Transport Agents configured to filter before other Transport Agents on your server?
http://vamsoft.com/support/docs/knowledge-base/changing-the-filtering-order
Do you have SMTP protocol logging enabled? If so, what does it indicate?
http://technet.microsoft.com/en-us/library/bb124531.aspx
http://technet.microsoft.com/en-us/library/aa997624.aspx
@Krisztián Fekete (Vamsoft):
Hi Krisztian,
I see that the ORF transport agents are configured currently to run last - do folks typically change that? I see that Exchange has several that come first then AVG...
And the two SMTP protocol logging articles you mention above talk about Exchange 2013 - I'm running 2007. I can search for them or if you have them handy...
And last, I didn't get an e-mail notification of your comment - does that tell you anything?
Thanks,
Jerry
Ok, I see I don't have SMTP protocol logging enabled - I'll get it turned on and do some troubleshooting but later :( Gotta head to work...
@jhoff:
I see there's agent logging enabled and I find entries like the following ( is my work e-mail address):
generated entry,
2014-02-21T09:09:34.349Z,08D0FCF96ECE9270,192.168.10.2:2525,216.146.32.23:64437,10.3.20.208,,,;,,1,Connection Filtering Agent,OnEndOfHeaders,RejectMessage,550 5.7.1 External client with IP address 10.3.20.208 does not have permissions to submit to this server. Visit http://support.microsoft.com/kb/928123 for more information.,LocalBlockList,machine-generated entry,
Disabling the IP Block List in Exchange seems to be allowing mails thru. Probably I need to configure the same intermediate hosts (216.146.32.0/23) in Exchange or leave this disabled?
Wonder why this just recently started... And interesting I don't see a way in exchange to actually see the list of blocked IPs and I see I don't have any block list providers enabled. Sigh, I need to do some research...
@jhoff:
"I see that the ORF transport agents are configured currently to run last - do folks typically change that?"
Most people want ORF to filter and log first (because the logging of ORF is awesome, though I'm a little biased), so I recommend changing the filtering order at least for troubleshooting the problem (there should not be any issues, and you change it back anytime).
"And the two SMTP protocol logging articles you mention above talk about Exchange 2013 - I'm running 2007. I can search for them or if you have them handy..."
http://clintboessen.blogspot.hu/2009/06/exchange-2007-smtp-protocol-logging.html
"And last, I didn't get an e-mail notification of your comment - does that tell you anything?"
Not sure... I will ask our web dev guy to check if the problem is on our end. Thanks for reporting.
Btw, now that I disabled the IP Block List in Exchange allowed the notification for your above comment to come thru...
I've noticed recently that mail has been getting lost and I think the start coiencides with my install of 5.2 B1. What I'm seeing in the ORF logs is the entry for the before arrival tests which show as whitelisted due to it being from an intermediate host (I have all mails proxied thru dyndns) but no on log entry for on-arrival at all?
For example before leaving work tonite, I tried to forward a mail from my work e-mail to home and it too sending it 3 times before it actually arrived. I DO see the before arrival log entry for all 3 but only the on arrival (whitelist for auto sender whitelist) log entry only for the third one which then arrived in my mailbox.
Could Exchange be eating these too?