SMTP connector ques filling up, outgoing mail not moving. : Microsoft, Exchange Server 2003 sp1, 2003 SP1, installed on an active/passive cluster

May 17, 2008 03:01am pdt

1. KCTS 120,453
2. leew 42,555
3. oBdA 42,210
4. MrHusy 36,800
5. martin_b... 33,040
6. RobWill 32,620
7. tigermatt 28,125
8. TechSoEasy 28,100
9. LauraEHu... 27,759
10. toniur 27,475
11. lnkevin 25,680
12. merowinger 24,000
13. SteveH_UK 22,898
14. mboppe 22,442
15. Chris-Dent 21,800

1. KCTS 860,775
2. farhankazi 463,550
3. MrHusy 405,351
4. Sembee 327,964
5. TechSoEasy 287,434
6. oBdA 212,756
7. leew 196,786
8. LauraEHu... 186,651
9. sirbounty 150,360
10. Jay_Jay70 137,821
11. toniur 132,816
12. mboppe 127,190
13. tigermatt 116,488
14. RobSampson 109,475
15. RobWill 108,509

02.07.2008 at 11:04AM PST, ID: 23145477

	[x] Attachment Details

[x]

The Solution Rating System

With so many solutions, how can you tell which solutions are most likely to help you and which ones are not? To provide you with a tool to use, we rate our solutions based on various elements that most accurately determine if a solution is a quality solution. To explain what factors affect the solution rating, here are the elements we take into consideration when formulating our solution rating.

The Grade of the Solution
The Zone Rank of the Expert Providing the Solution
The Number of Author and Expert Comments
The Number of Experts Contributing
The Feedback of the Community

Your Input Matters
Because of the way the system is set up, the most important variable in this equation is you. As a member of Experts Exchange, you are able to cast your vote on the quality of the solutions in regard to how complete, accurate, helpful and easy to understand each solution is. When you provide your feedback, each rating is adjusted accordingly. So, if you see a solution that has a poor rating that you think is a good solution, let us know by rating it. As you do, the rating will be adjusted and will become more accurate for other members of our site.

If you have any suggestions that you would like to make for our rating system, please ask a question in the Suggestions Zone of Community Support.

Thank you!

4.2

SMTP connector ques filling up, outgoing mail not moving.

Zones: Server, Exchange Email Server, Simple Mail Transfer Protocol (SMTP)

Tags: Microsoft, Exchange Server 2003 sp1, 2003 SP1, installed on an active/passive cluster

We are running a single Exchange server, in an active/passive cluster. In the past two days all outgoing smtp traffic has been at a standstill. Messages simply sit in their que in a retry state until they expire. I have noticed that if i fail over from sever1 to server2 smtp flows for about a min or so. this is really startign to cause problems and needs to get fixed. I have called micorsoft to no avail, so i am at the feet of the experts here. we have made no changes to the system in the past few months.
thank you,

Start your free trial to view this solution

Question Stats

Zone: OS

Question Asked By: aksealife

Solution Provided By: opie6373

Participating Experts: 4

Solution Grade: A

Translate:

Loading Advertisement...

Microsoft

Internet Protocols
Applications

Development
OS

Hardware
Windows Security

Apple

Operating Systems
Hardware

Programming
Networking

Software

Internet

Search Engines
File Sharing
WebTrends / Stats
Spy / Ad Blockers

Web Browsers
New Net Users
Web Development
Chat / IM

Anti Spam
Web Servers
Anti-Virus
Email Clients

Gamers

Tips
Online / MMORPG
Puzzle
Emulators

Action / Adventure
Role Playing
Consoles
Game Programming

Strategy
Sports
Misc
Computer Games

Digital Living

Hardware
New Net Users
New Users

Software
Digital Music
Gaming World

Home Security
Apple
Networking Hardware

Virus & Spyware

Vulnerabilities
IDS
Encryption
Anti-Virus

Operating Systems Security
Software Firewalls
WebApplications
Cell Phones

Operating Systems
Internet
Hardware Firewalls

Hardware

Handhelds / PDAs
Displays / Monitors
Components
Networking Hardware

Peripherals
Laptops/Notebooks
Storage
Servers

Desktops
New Users
Misc
Apple

Software

System Utilities
Industry Specific
Network Management
Photos / Graphics
Page Layout
VMWare
Misc
Web Development

OS
CYGWIN
Voice Recognition
Message Queue
Quality Assurance
Security
Firewalls
MultiMedia Applications

Development
Database
Office / Productivity
Business Management
OS/2 Apps
Server Software
Internet / Email

ITPro

OS
Storage
Encryption
Operating Systems Security
Apple Hardware
Laptops & Notebooks
Servers
Networking Hardware
Peripherals

Devices
Displays / Monitors
WebTrends / Stats
Search Engines
Firewalls
WebApplications
IDS
Vulnerabilities
Email Clients

File Sharing
Spy / Ad Blockers
Web Browsers
Web Servers
Networking
Anti-Virus
Chat / IM
Anti Spam

Developer

Web Servers
Web Browsers
Game Programming
Dev Tools
Industry Specific
Office / Productivity

Database
CYGWIN
Web Development
Search Engines
File Sharing
WebTrends / Stats

Programming
Content Management
Application Servers
Protocols

Storage

Removable Backup Media
Storage Technology
Servers

Grid
Remote Access
Backup / Restore

Misc
Hard Drives

Miscellaneous
Security
Development
Linux
VMWare

MainFrame OS
Unix
Apple
OS / 2
AS / 400

BeOS
Microsoft
VMS / OpenVMS

Database

Oracle
Miscellaneous
MySQL
Software
Sybase
Contact Management
PostgreSQL
Data Manipulation
Clarion
InterSystems Cache

Siebel
MUMPS
OLAP
SQLBase
SAS
GIS & GPS
4GL
Berkeley DB
DB2
Informix

Interbase / Firebird
FoxPro
Reporting
LDAP
Filemaker Pro
MS SQL Server
dBase
MS Access

Security

Misc
Web Browsers
Software Firewalls
Operating Systems Security
File Sharing

Spy / Ad Blockers
Vulnerabilities
WebApplications
IDS
Anti-Virus

Encryption
Anti Spam
Email Clients
VPN
Chat / IM

Programming

Editors IDEs
Installation
Handhelds / PDAs
Multimedia Programming
System / Kernel

Algorithms
Game
Signal Processing
Project Management
Open Source

Database
Misc
Languages
Processor Platforms
Theory

Web Development

Scripting
Blogs
Web Servers
Software
Search Engines
Web Graphics
Images

Internet Marketing
Images and Photos
Components
Document Imaging
Web Languages/Standards
Illustration
WebApplications

Fonts
WebTrends / Stats
Authoring
Digital Camera Software
Miscellaneous

Networking

Protocols
Apple Networking
Network Management
Message Queue
Application Servers
Content Management
File Servers
Email Servers
Misc
Java Editors & IDEs

Wireless
Networking Hardware
Backup / Restore
System Utilities
ISPs & Hosting
Web Servers
Storage Technology
Removable Backup Media
Servers
Broadband

Grid
OS / 2
Novell Netware
Unix Networking
Windows Networking
Security
Telecommunications
Operating Systems
Linux Networking

Other

Community Advisor
Lounge
Community Support
New Net Users

Philosophy / Religion
Math / Science
Miscellaneous
URLs

Expert Lounge
Politics
Puzzles / Riddles

Community Support

Suggestions
New to EE
New Topics
Community Advisor

CleanUp
Announcements
General

Feedback
Input
EE Bugs

02.07.2008 at 11:11AM PST, ID: 20843963

paul-adam:

what errors (if any) are you getting in your event logs?

Does the SMTP service stop when mailflow stops?

Has your public mailserver IP maybe been blacklisted?

Assisted Solution

02.07.2008 at 11:14AM PST, ID: 20843996

vishal_impact:

OK
if you have made no changes than i rec its with your isp tell me more about the services your isp is hostin for you as well which outgoing server you using and also if you can check the mx records .....
BUT B$ doint this I woul suggest to try this on smtp virtual server right click stop and start service and do same on the mail connector and resart the smtp,DNS,and iis serevices and see it this works otherwise give me the mentioned details

02.07.2008 at 11:29AM PST, ID: 20844149

aksealife:

If i go in to the event viewer i have the following error in the application log.

"This is an SMTP protocol error log for virtual server ID 1, connection # 1174. The remote hos "12.191.22.203", responded to the SMTP command "rcpt" with "550.5.7.0 <jquutyhoiav@ifh.com>...Local Policy Violation ". The full commnad sent was "RCPT TO: <jquutyhoiav@ifh.com> ". This will probably cause the connection to fail."

i have this error multiple times, 100+ in the log.

02.07.2008 at 11:34AM PST, ID: 20844186

vishal_impact:

Ok
its with the user policy if you check in policy setting have you got priority highest to emails

02.07.2008 at 12:27PM PST, ID: 20844707

aksealife:

Where do i check this?

02.07.2008 at 12:32PM PST, ID: 20844765

aksealife:

SMTP services does not stop when mail flow stops.

I checked and our domain has not been blacklisted.

Internal email is flowing normally and we can recieved all outside mail, but still not able to send outside.

02.07.2008 at 12:38PM PST, ID: 20844855

paul-adam:

Well.....the "local policy violation" is being generated by the opposite ends mailserver so something your server is sending out is violating a policy setting at the destination - The email addresses in the error messages - are they all the same or are they different addresses?

02.07.2008 at 12:40PM PST, ID: 20844892

paul-adam:

have you added any new DNS records...like an SPF record or maybe even a reverse lookup on your mail servers public ip?

02.07.2008 at 12:45PM PST, ID: 20844959

InfraTech:

in your log entry above, it says the REMOTE host responded with "550.5.7.0 Local Policy Violation" so the policy being referenced is from the remote server. My guess is that they are classifying your email as SPAM or the person you are sending to mailbox is full.

I would try the SMTPDIAG program from Microsoft located here http://www.microsoft.com/downloads/details.aspx?FamilyID=bc1881c7-925d-4a29-bd42-71e8563c80a9&displaylang=en

Its helped me numerous times. you can also try to use telnet following the steps outlined here http://support.microsoft.com/kb/153119 but the SMTPDIAG is easiest

02.07.2008 at 12:48PM PST, ID: 20844991

aksealife:

The email addresses in the error log are all different. there are also event warnings that calling client does not have permission to use MTA RPCs. Outgoing emails are slowly moving thorugh que on passive cluster, but still getting errors. No new records have been added, but we have instituted GFI recently, which was working fine till last week. we have uninstalled and disabled it now in effort to get email back on track.

02.07.2008 at 01:05PM PST, ID: 20845181

Rank: Master

opie6373:

which GFI product? did the uninstall resolve the issue?

02.07.2008 at 01:19PM PST, ID: 20845332

aksealife:

We had GFI MailEssentials 12, the latest build, installed on the Exchange Server cluster, and GFI Mailarchiver 4 running on a seperate server. Unistalled MailEssentials and that did not solve the issue

02.07.2008 at 01:21PM PST, ID: 20845358

aksealife:

Also outgoing mail appears to work when i fail over to the passive, server2, on the cluster. Any thoughts as to why smtp does not work on server1, but does on server2?

02.07.2008 at 01:36PM PST, ID: 20845534

Rank: Master

opie6373:

it sounds like it could be related to gfi but you've uninstalled and restarted exchange?

i would download the exchange troubleshooting assistant, http://www.microsoft.com/Downloads/details.aspx?FamilyID=4bdc1d6b-de34-4f1c-aeba-fed1256caf9a&displaylang=en
there is a way to troubleshoot mail flow issues.

i would do some google searches on those errors you have in your event logs.

regarding the local security violation in the logs.. is that all from the same domain?

something is different between the two servers, something on server 1 is causing it not to work. we just have to figure out what

02.07.2008 at 01:37PM PST, ID: 20845539

Rank: Master

opie6373:

also try the smtp diag as suggested above.

02.07.2008 at 01:39PM PST, ID: 20845556

Rank: Master

opie6373:

check to make sure you aren't an open relay---go to dnsstuff.com and do a report on your domain. it might not be free anymore but a dnsstuff membership is cheap and is a good tool

Accepted Solution

02.07.2008 at 01:39PM PST, ID: 20845559

Rank: Master

opie6373:

try those and report back, i've gotta leave work now, i'll check back when i get home and see how you are doing

02.07.2008 at 02:36PM PST, ID: 20846111

aksealife:

did the dnsstuff report and all was good. now i am just attempting to find the difference between server1 and sever2 that is causing server1 to not allow SMTP. And yes, i did an unistall of GFI mailessentials and restarted both servers, as it was installed on the shared drive between the cluster.

02.07.2008 at 05:06PM PST, ID: 20846989

Rank: Master

opie6373:

yep, compare the smtp virtual server settings and smtp connector settings.

02.08.2008 at 12:21AM PST, ID: 20848615

vishal_impact:

HI
OK i can ask you to try one way around if you have a mail connector it will forward all your mails as well and bear in mind the mail connector will override your smtp virtual server setting so all what you can try is stop the smtp server then restar the connectoe and iis services and test the folw if its still blocking then try creating new smtp and see if that works and also make sure to add these new smtp in your connector as well.

Assisted Solution

02.08.2008 at 06:03PM PST, ID: 20855905

aksealife:

OK, first off thank you to all that have offered help so far,
After another 4hrs with my good buddy at microsoft, this is what we have come up with. When i am on node2 of the cluster mail flows in and out like normal, all smtp traffic is normal. When i am on node1 all internal mail flows normally, and outgoing smtp is blocked. i went to dnsgoodies.com and checked my IP of the firewall, and mx recored. When i am on node1 all return as blocked, but if i go to node2 only a few return as blocked or blacklisted. The MS tech is leading me to believe that a machine on our network is infected with the STORM worm. I am currently scanning all workstations in an attempt to find the infected machine. This would also explain why we have been getting large jumps in bandwidth usage at very strange times of day. Any other thoughts or idea would be most helpful.

02.09.2008 at 10:41AM PST, ID: 20858185

Rank: Master

opie6373:

"i went to dnsgoodies.com and checked my IP of the firewall, and mx recored. When i am on node1 all return as blocked". What do you mean "all return as blocked"?

what is leading him to believe that you have a pc with the storm worm? the bandwidth? as far as i know that worm targets systems running iis 4 or 5 that don't have a certain ms update. do you have a machine that is/was running iis 4 or 5?

when your outbound email slows down and stops, what do you see in your queues? do you see alot of smtp connectors to external domains?

the worm can do two things, make the pc part of a botnet and/or send numerous outbound emails.

do you have any internet reporting software (websense for example)? that would help

if you have the storm worm on one of your client machines i don't understand why it would affect the smtp on one server and not another

02.09.2008 at 05:26PM PST, ID: 20859564