Re: C150 Refusing Particular Messages from Exchange

artesvida_ironport · ‎09-02-2009

I have a C150 set up as an SMTP connector for my Exchange system. Works great. Problem is, once every couple of months, a particular message from a particular user will get "stuck" in the SMTP queue. I find out because someone will complain that outbound messages aren't getting delivered, and I'll see that the SMTP queue has some messages in it. If I force a connection, all of the messages go through, *except* the particular message from the particular user. If I look at the properties of the message, it's been retried hundreds of times. This message, no matter how long I wait, will never go through. From Exchange, I need to delete the message, then the user tries again. Invariably, when the user creates a new message and tries it again, it works fine.

I checked the IronPort logs, and I can't find any evidence that the message is touching the system. I can't find anything in the IronPort error logs that has anything to do with this message. But, apart from the fact that the message, when stuck in the SMTP queue, is marked as "Retry", I don't see anything in the Exchange logs that indicates there is a problem with the message or communicating with the IronPort. Is this an IronPort problem? If so, does anyone have any suggestions? Or is this an Exchange problem? I find it peculiar that it is always the same user (makes you think that it's an end-user problem) but I can see *nothing* weird about the messages that she is sending. And she sends out another message that is essentially identical to the first, and the 2nd one goes through.

kluu_ironport · ‎09-03-2009

What is particular about this message?

Is it reproducible at all? For the message that occurs to be stuck when this particular sender sends the message, can you save that message as an EML or MBOX format for further testing?

You should contact Support the next time this sender/msg causes a bottleneck between Exchange and the C150. You may want to enable the injection debug log and see what data is transmitted in the SMTP conversation when the retry is done. If the ESA injection debug logs don't show anything, then the ESA is not *hearing* the call from your Exchange.

How do I analyze mail delivered to the Email Security Appliance (ESA)?
http://tinyurl.com/y9f5ca

I have a C150 set up as an SMTP connector for my Exchange system. Works great. Problem is, once every couple of months, a particular message from a particular user will get "stuck" in the SMTP queue. I find out because someone will complain that outbound messages aren't getting delivered, and I'll see that the SMTP queue has some messages in it. If I force a connection, all of the messages go through, *except* the particular message from the particular user. If I look at the properties of the message, it's been retried hundreds of times. This message, no matter how long I wait, will never go through. From Exchange, I need to delete the message, then the user tries again. Invariably, when the user creates a new message and tries it again, it works fine.

I checked the IronPort logs, and I can't find any evidence that the message is touching the system. I can't find anything in the IronPort error logs that has anything to do with this message. But, apart from the fact that the message, when stuck in the SMTP queue, is marked as "Retry", I don't see anything in the Exchange logs that indicates there is a problem with the message or communicating with the IronPort. Is this an IronPort problem? If so, does anyone have any suggestions? Or is this an Exchange problem? I find it peculiar that it is always the same user (makes you think that it's an end-user problem) but I can see *nothing* weird about the messages that she is sending. And she sends out another message that is essentially identical to the first, and the 2nd one goes through.

viahmed_ironport · ‎09-03-2009

I have a C150 set up as an SMTP connector for my Exchange system. Works great. Problem is, once every couple of months, a particular message from a particular user will get "stuck" in the SMTP queue. I find out because someone will complain that outbound messages aren't getting delivered, and I'll see that the SMTP queue has some messages in it. If I force a connection, all of the messages go through, *except* the particular message from the particular user. If I look at the properties of the message, it's been retried hundreds of times. This message, no matter how long I wait, will never go through. From Exchange, I need to delete the message, then the user tries again. Invariably, when the user creates a new message and tries it again, it works fine.

I checked the IronPort logs, and I can't find any evidence that the message is touching the system. I can't find anything in the IronPort error logs that has anything to do with this message. But, apart from the fact that the message, when stuck in the SMTP queue, is marked as "Retry", I don't see anything in the Exchange logs that indicates there is a problem with the message or communicating with the IronPort. Is this an IronPort problem? If so, does anyone have any suggestions? Or is this an Exchange problem? I find it peculiar that it is always the same user (makes you think that it's an end-user problem) but I can see *nothing* weird about the messages that she is sending. And she sends out another message that is essentially identical to the first, and the 2nd one goes through.

Hi,

If it is not hitting to IronPort than it shouldn't be an IronPort issue, but you may want to try configuring injection debug log for your exchange server and try sending some test messages, you might get lucky if the message stuck in the SMTP queue again.

Best of luck.

Regards,
Viquar Ahmed
Customer Support Engineer IronPort

artesvida_ironport · ‎09-03-2009

Thanks for the info on the injection debug logs. That's the sort of logging I was looking for, but didn't realize I needed to configure and enable.

I didn't contact support this time because I've already done so, and their response (as Viquar as written) is that it isn't an IronPort problem. I'm willing to believe them, but I'm not completely convinced, so I posted the question here.

I will turn on the injection debug logs, and see what gets logged if/when this happens again. Thank you!