Solved

Mail is missing

Posted on 2004-10-21
18
343 Views
Last Modified: 2013-12-18
Hi everybody.

I got a really big problem. We have a Symantec SMTP Server in our DMZ accepting mail from everywhere in the world to our domain. This server checks for viruses, and sends the mail through our firewall to our Lotus Domino 5.0.8 server.

I got especially one user, don't know if it is more than one, that got problems with receiving e-mails. The user knows someone has sent him an email, but he doesn't receive it.

When checking the logs, the log on the Symantec SMTP Server looks good. I have pasted an anonymized clip from the log in the bottom of this mail.
But in Notes Log, I can't find this message at all. At this point in time in the Notes Log I can see 2 connections from the Symantec SMTP server, but only one mail beeing delivered to the Domino-server.

Does anyone have an idea what can be wrong?? Or at least how I should troubleshoot??

I have seen a couple of the undelivered mails. This is a random problem, it's not a problem from some specific senders. The only thing I know these senders have in common is that they are using MS Exchange, but that should not be a problem. They even use different ISP's, and actually one of them was from our ISP.

I do not know where to go from here. Please help!

Best Regards


Rune Millerjord


Log from Symantec SMTP Server:
---------------------------------------------------------------------------------------------------------------------
19-Oct-2004 15:49:50  Action: Message Accepted  Client: IP.IP.IP.IP  From: secret2@secret2.com  
To: secret@secret.com  Subject: RE: Oppdatering kultur  Size: 3465  
SMTP ID: M2004101915495029065  Connection ID: 3863  

19-Oct-2004 15:49:50  Action: Disconnected  Client: IP.IP.IP.IP  Connection ID: 3863  

19-Oct-2004 15:49:56  Action: Connected To  Result: Succeeded  Server: 10.100.10.2:25  
Connection ID: 3865  Info: Actual  

19-Oct-2004 15:49:56  Action: Message Delivered  Server: 10.100.10.2:25  To: secret@secret.com  
SMTP ID: M2004101915495029065  Connection ID: 3865  Last Response: 250 Message accepted for delivery  

19-Oct-2004 15:49:57  Action: Disconnected  Server: 10.100.10.2:25  Connection ID: 3865  
Info: Cached  

19-Oct-2004 15:49:57  Action: Message Processing Completed  Client: IP.IP.IP.IP  SMTP ID: M2004101915495029065
0
Comment
Question by:Millerjord
  • 6
  • 6
  • 4
  • +1
18 Comments
 
LVL 46

Expert Comment

by:Sjef Bosman
Comment Utility
Hi Rune,

And around the time of the logged mail, there are no entries in the Notes-log? Do you have an extract of the Miscellaneous log for us? Is 10.100.10.2 the IP-address of the Domino-server?

I've never seen mail going missing without at least leaving a trace...
0
 
LVL 15

Expert Comment

by:Bozzie4
Comment Utility
Your log excerpt shows only 1 mail - so what exactly is the problem ?  

On the Domino server, enable the full level of mail logging.  You can do this through a notes.ini setting (see in the Configuration document, the setting is there - it's log_mail or something).

cheers,


Tom
0
 

Author Comment

by:Millerjord
Comment Utility
Hi

10.100.10.2 is the IP-address of my Domino-server. Spenst is the name of the Symantec SMTP Server in my DMZ. And for the record, noticed the time on the Domino-server and the SMTP-server differs with 21 minutes. The Domino-server is 21 minutes earlier than the SMTP-server.

Here is some Notes log extract:

MISC-LOG:
19.10.2004 15:24:32   Router: Transferred 1 messages to Spenst (host Spenst) via SMTP
19.10.2004 15:24:32   Router: No messages transferred to Spenst (host Spenst) via SMTP
19.10.2004 15:25:48   Router: No messages transferred to Spenst (host Spenst) via SMTP
19.10.2004 15:25:48   Router: Transferred 1 messages to Spenst (host Spenst) via SMTP
19.10.2004 15:26:14   Router: Transferred 1 messages to Spenst (host Spenst) via SMTP
19.10.2004 15:26:15   Router: No messages transferred to Spenst (host Spenst) via SMTP
19.10.2004 15:26:15   Router: Transferred 1 messages to Spenst (host Spenst) via SMTP
19.10.2004 15:28:00   Router: Transferred 1 messages to Spenst (host Spenst) via SMTP
19.10.2004 15:28:27   Router: Transferred 1 messages to Spenst (host Spenst) via SMTP
19.10.2004 15:28:41   Router: Transferred 1 messages to Spenst (host Spenst) via SMTP
19.10.2004 15:30:35   Router: Transferred 1 messages to Spenst (host Spenst) via SMTP

Mail routing log:
19.10.2004 15:28:00   Router: Transferred 1 messages to Spenst (host Spenst) via SMTP
19.10.2004 15:28:00   Router: Message 0049F98D delivered to Rune Millerjord/Narvik/Narvik kommune
19.10.2004 15:28:05   Router: Message 0049F9CA transferred to Spenst for chriliepelt@hotmail.com via SMTP
19.10.2004 15:28:06   SMTP Server: 62.176.195.177 disconnected. 1 message[s] received
19.10.2004 15:28:06   SMTP Server: 62.176.195.177 disconnected. 1 message[s] received
19.10.2004 15:28:12   Router: Message 0049FF4C delivered to Willy Wøllo/Narvik/Narvik kommune
19.10.2004 15:28:24   Router: Transferring mail to domain Spenst (host Spenst [62.176.195.177]) via SMTP
19.10.2004 15:28:26   Router: Message 0049E144 delivered to Eva Kristin Johnson/Narvik/Narvik kommune
19.10.2004 15:28:27   Router: Transferred 1 messages to Spenst (host Spenst) via SMTP

As you can see of the MiscEvents-log I don't have enabled the full level of mail logging.

I have now enabled it using the Mail_Log_To_MiscEvents=1 in Notes.ini, and restartet the server.

Thanks to all of you, so far!

-Rune-
0
 
LVL 46

Expert Comment

by:Sjef Bosman
Comment Utility
I don't know if the time difference could be the source of all trouble. You could at least try to synchronize all your servers with some internet-clock. Make the Spenst-server listen to an Internet-clock, and make the Domino-server listen to the time on the Spenst-server. There are lots of reliable time-servers on the Internet, so synchronization shouldn't be a problem. On Linux, see ntp and /etc/ntp.conf
0
 
LVL 46

Expert Comment

by:Sjef Bosman
Comment Utility
0
 
LVL 15

Expert Comment

by:Bozzie4
Comment Utility
On Windows 2000, ntp protocol is also standard.  Use w32time and the Win 2000 time service counterpart (I forgot what it's called) to configure it.
On Windows NT, you'll have to download a tool to take care of time synchronization.

cheers,

Tom
0
 
LVL 31

Assisted Solution

by:qwaletee
qwaletee earned 125 total points
Comment Utility
Turn on message tracking, shold make it easier to track down the message.  If you have R6, mail journaling can also help.  Make suret he two servers have synchronized clocks, so you can check the console log/misc events/mail routing events.
0
 
LVL 31

Expert Comment

by:qwaletee
Comment Utility
What I also find interesting is that within 21 seconds of the two SMTP inbound messages arriving, there are four messages delievered -- two internally (Willy and Eva), and to back to the Symantec server.  Can you track down those messages?  The internal ines are pretty easy -- you will have the delivery times in the mail file,and you can match the end of the UNID to the message numbers.  The other two would involve comparing the information you provided here to the Symantec logs.

Also, log_mail_to_miscevents doesn't do much -- it just put the stuff that is already in Mail Routing Events in Misc Events.  You waant to increase the LEVEL of mail logging instead.

19.10.2004 15:28:06   SMTP Server: 62.176.195.177 disconnected. 1 message[s] received
19.10.2004 15:28:06   SMTP Server: 62.176.195.177 disconnected. 1 message[s] received
19.10.2004 15:28:12   Router: Message 0049FF4C delivered to Willy Wøllo/Narvik/Narvik kommune
19.10.2004 15:28:24   Router: Transferring mail to domain Spenst (host Spenst [62.176.195.177]) via SMTP
19.10.2004 15:28:26   Router: Message 0049E144 delivered to Eva Kristin Johnson/Narvik/Narvik kommune
19.10.2004 15:28:27   Router: Transferred 1 messages to Spenst (host Spenst) via SMTP
0
 

Author Comment

by:Millerjord
Comment Utility
Hi Qwaletee.

First one question, how do I increase the level of mail logging??

About the mail routing log, as far as I can see from the different logs, one of the two mails received from the SMTP server in the DMZ at 15:28:06 is the one that have disappeared.

The internal mails might have come internally, it does not have to come from the SMTP server in the DMZ.

-:Rune:-
0
How to improve team productivity

Quip adds documents, spreadsheets, and tasklists to your Slack experience
- Elevate ideas to Quip docs
- Share Quip docs in Slack
- Get notified of changes to your docs
- Available on iOS/Android/Desktop/Web
- Online/Offline

 
LVL 46

Accepted Solution

by:
Sjef Bosman earned 125 total points
Comment Utility
Search your Admin Help db for "mail and level", you'll find a document called "Changing the logging level for mail": http://www-12.lotus.com/ldd/doc/domino_notes/Rnext/help6_admin.nsf/855dc7fcfd5fec9a85256b870069c0ab/7e98fb2a9a6834ca85256c1d003956cd?OpenDocument&Highlight=0,mail,level

To search other documents, see http://www-12.lotus.com/ldd/doc/domino_notes/Rnext/help6_admin.nsf/Main?OpenFrameSet

Did you manage to synchronize the clocks?
0
 

Author Comment

by:Millerjord
Comment Utility
Hello everyone

I have managed to sync the clock, and to change the logging level for mail.

Now I just have to wait and see if some mail is missing, will check the log on monday.

Does anyone have an idea what I should look for?? As I mentioned, this is random!! An many users may have lost an email without knowing it!

Thanks to all of you, so far.

-:Rune:-
0
 
LVL 46

Expert Comment

by:Sjef Bosman
Comment Utility
It's like looking at a black hole in the universe: you know it's there but you can see nothing. You could set up some service to send lots of mails, say every minute (marked), to your own address or a test-address. If you miss one, then start checking.

One more question: have any INTERNAL mails gone missing, or are only EXTERNAL mails (that passed the DMZ SMTP server) untraceable? By the way, do your internal users send SMTP-mails to the Domino-server directly?

I think we're in the same timezone (CET+1), so you've been at it quite late as well.

*Yawn* Bye for today!
0
 

Author Comment

by:Millerjord
Comment Utility
Good Morning Sjef!

I know some Internal mails have disappeared as well, but not in quite a while. But at that time I just thought it was a user error.

But when the second and third mentioned missing mails, I started searching. But I couldn't find anything in the logs. Now I see much info in the logs, so I will think I can find something next time someone is missing a mail.

I will create an agent on my Notes client at home that sends mail to my test account every minute.

And by the way, no internal USERS send SMTP-mail to the Domino, but I have some applications and equipment that do!

-:Rune:-
0
 
LVL 31

Expert Comment

by:qwaletee
Comment Utility
Don't forget to turn on MTC, as it is a spearate mail logging system with much greater detail.  (However, since it operates "at a distance" to the core logging facilities, it may not include info on teh missing messages... still, if it does, it will provide more info than the basic logging, no matter what level you tur it up to.)

Finally, if you have R6, you can tunr on mail journaling, so that you keep a copy of every message that passes through the router.
0
 

Author Comment

by:Millerjord
Comment Utility
Hi everyone

Now I have come one step ahead.

First I want to remind you my Domino-server is running version 5.0.8!!

I have found I mail that is missing, and now I found it in the Notes-log too. And it looks like this:

27.10.2004 11:16:52   Router: Message 0032FB71 for CN=Bjørn Selnes/OU=Narvik/O=Narvik kommune deleted by mail rule filter
27.10.2004 11:16:52   Router: Message 0032FB71 delivered to Bjørn Selnes/Narvik/Narvik kommune from hans.skoglund@funn.no OF216F5057:807A26FA ONC1256F3A:0032FB71 Size: 5K Hop Count: 1

But as far as I know i don't have any mail rule filters. How can I set a mail rule filter?? And why does it say delivered?? It sure isn't delivered!!

Now I think we have come pretty near the bottom of this. HELP!!

-:Rune:-
0
 

Author Comment

by:Millerjord
Comment Utility
Hi again.

I have searched the log for similar occurencies today, and I have found 10 deleted mails.

Please don't tell me this mail rule filter is implemented on the client mailbox, a setting the user have set himself!! If it is, somebody is going to lose their balls!!

The reason I ask this question is because the deleted mails are tried delivered to 2 different users, and both have implemented a pretty long list of rules to avoid spam manually. And as we all know, spam filters may eat a little more than they should.

Maybe the mystery is solved......

-:Rune:-
0
 
LVL 46

Expert Comment

by:Sjef Bosman
Comment Utility
> Please don't tell me this mail rule filter is implemented on the client mailbox, a setting the user have set himself!! If it is, somebody is going to lose their balls!!

Make him go to the sperm bank first!

Most likely the mystery is solved :)
0
 
LVL 31

Expert Comment

by:qwaletee
Comment Utility
I would say you've got it!

It would probably be better if instead of deleting, they moved such messages to a spam folder, so they could at least check what's moving through there once in a while.

I believe soft deletios would not help you here, because I think the rule deletes the document before it even arrives nto teh mail database, so it is not soft deleted, it is simply not delievered.  (The router says it was delivered, because it was handed off to the router dlievery code, and the logging is not that granular).
0

Featured Post

How your wiki can always stay up-to-date

Quip doubles as a “living” wiki and a project management tool that evolves with your organization. As you finish projects in Quip, the work remains, easily accessible to all team members, new and old.
- Increase transparency
- Onboard new hires faster
- Access from mobile/offline

Join & Write a Comment

Lack of Storage capacity is a common problem that exists in every field of life. Here we are taking the case of Lotus Notes Emails, as we all know that we are totally depend on e-communication i.e. Emails. This article is fully dedicated to resolvin…
This article covers general Notes 8.5 troubleshooting information including recreating the Notes\Data folder.
Polish reports in Access so they look terrific. Take yourself to another level. Equations, Back Color, Alternate Back Color. Write easy VBA Code. Tighten space to use less pages. Launch report from a menu, considering criteria only when it is filled…
This video demonstrates how to create an example email signature rule for a department in a company using CodeTwo Exchange Rules. The signature will be inserted beneath users' latest emails in conversations and will be displayed in users' Sent Items…

728 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

10 Experts available now in Live!

Get 1:1 Help Now