Solved

Mail is missing

Posted on 2004-10-21
18
349 Views
Last Modified: 2013-12-18
Hi everybody.

I got a really big problem. We have a Symantec SMTP Server in our DMZ accepting mail from everywhere in the world to our domain. This server checks for viruses, and sends the mail through our firewall to our Lotus Domino 5.0.8 server.

I got especially one user, don't know if it is more than one, that got problems with receiving e-mails. The user knows someone has sent him an email, but he doesn't receive it.

When checking the logs, the log on the Symantec SMTP Server looks good. I have pasted an anonymized clip from the log in the bottom of this mail.
But in Notes Log, I can't find this message at all. At this point in time in the Notes Log I can see 2 connections from the Symantec SMTP server, but only one mail beeing delivered to the Domino-server.

Does anyone have an idea what can be wrong?? Or at least how I should troubleshoot??

I have seen a couple of the undelivered mails. This is a random problem, it's not a problem from some specific senders. The only thing I know these senders have in common is that they are using MS Exchange, but that should not be a problem. They even use different ISP's, and actually one of them was from our ISP.

I do not know where to go from here. Please help!

Best Regards


Rune Millerjord


Log from Symantec SMTP Server:
---------------------------------------------------------------------------------------------------------------------
19-Oct-2004 15:49:50  Action: Message Accepted  Client: IP.IP.IP.IP  From: secret2@secret2.com  
To: secret@secret.com  Subject: RE: Oppdatering kultur  Size: 3465  
SMTP ID: M2004101915495029065  Connection ID: 3863  

19-Oct-2004 15:49:50  Action: Disconnected  Client: IP.IP.IP.IP  Connection ID: 3863  

19-Oct-2004 15:49:56  Action: Connected To  Result: Succeeded  Server: 10.100.10.2:25  
Connection ID: 3865  Info: Actual  

19-Oct-2004 15:49:56  Action: Message Delivered  Server: 10.100.10.2:25  To: secret@secret.com  
SMTP ID: M2004101915495029065  Connection ID: 3865  Last Response: 250 Message accepted for delivery  

19-Oct-2004 15:49:57  Action: Disconnected  Server: 10.100.10.2:25  Connection ID: 3865  
Info: Cached  

19-Oct-2004 15:49:57  Action: Message Processing Completed  Client: IP.IP.IP.IP  SMTP ID: M2004101915495029065
0
Comment
Question by:Millerjord
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 6
  • 6
  • 4
  • +1
18 Comments
 
LVL 46

Expert Comment

by:Sjef Bosman
ID: 12367517
Hi Rune,

And around the time of the logged mail, there are no entries in the Notes-log? Do you have an extract of the Miscellaneous log for us? Is 10.100.10.2 the IP-address of the Domino-server?

I've never seen mail going missing without at least leaving a trace...
0
 
LVL 15

Expert Comment

by:Bozzie4
ID: 12367526
Your log excerpt shows only 1 mail - so what exactly is the problem ?  

On the Domino server, enable the full level of mail logging.  You can do this through a notes.ini setting (see in the Configuration document, the setting is there - it's log_mail or something).

cheers,


Tom
0
 

Author Comment

by:Millerjord
ID: 12367843
Hi

10.100.10.2 is the IP-address of my Domino-server. Spenst is the name of the Symantec SMTP Server in my DMZ. And for the record, noticed the time on the Domino-server and the SMTP-server differs with 21 minutes. The Domino-server is 21 minutes earlier than the SMTP-server.

Here is some Notes log extract:

MISC-LOG:
19.10.2004 15:24:32   Router: Transferred 1 messages to Spenst (host Spenst) via SMTP
19.10.2004 15:24:32   Router: No messages transferred to Spenst (host Spenst) via SMTP
19.10.2004 15:25:48   Router: No messages transferred to Spenst (host Spenst) via SMTP
19.10.2004 15:25:48   Router: Transferred 1 messages to Spenst (host Spenst) via SMTP
19.10.2004 15:26:14   Router: Transferred 1 messages to Spenst (host Spenst) via SMTP
19.10.2004 15:26:15   Router: No messages transferred to Spenst (host Spenst) via SMTP
19.10.2004 15:26:15   Router: Transferred 1 messages to Spenst (host Spenst) via SMTP
19.10.2004 15:28:00   Router: Transferred 1 messages to Spenst (host Spenst) via SMTP
19.10.2004 15:28:27   Router: Transferred 1 messages to Spenst (host Spenst) via SMTP
19.10.2004 15:28:41   Router: Transferred 1 messages to Spenst (host Spenst) via SMTP
19.10.2004 15:30:35   Router: Transferred 1 messages to Spenst (host Spenst) via SMTP

Mail routing log:
19.10.2004 15:28:00   Router: Transferred 1 messages to Spenst (host Spenst) via SMTP
19.10.2004 15:28:00   Router: Message 0049F98D delivered to Rune Millerjord/Narvik/Narvik kommune
19.10.2004 15:28:05   Router: Message 0049F9CA transferred to Spenst for chriliepelt@hotmail.com via SMTP
19.10.2004 15:28:06   SMTP Server: 62.176.195.177 disconnected. 1 message[s] received
19.10.2004 15:28:06   SMTP Server: 62.176.195.177 disconnected. 1 message[s] received
19.10.2004 15:28:12   Router: Message 0049FF4C delivered to Willy Wøllo/Narvik/Narvik kommune
19.10.2004 15:28:24   Router: Transferring mail to domain Spenst (host Spenst [62.176.195.177]) via SMTP
19.10.2004 15:28:26   Router: Message 0049E144 delivered to Eva Kristin Johnson/Narvik/Narvik kommune
19.10.2004 15:28:27   Router: Transferred 1 messages to Spenst (host Spenst) via SMTP

As you can see of the MiscEvents-log I don't have enabled the full level of mail logging.

I have now enabled it using the Mail_Log_To_MiscEvents=1 in Notes.ini, and restartet the server.

Thanks to all of you, so far!

-Rune-
0
Technology Partners: We Want Your Opinion!

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

 
LVL 46

Expert Comment

by:Sjef Bosman
ID: 12367948
I don't know if the time difference could be the source of all trouble. You could at least try to synchronize all your servers with some internet-clock. Make the Spenst-server listen to an Internet-clock, and make the Domino-server listen to the time on the Spenst-server. There are lots of reliable time-servers on the Internet, so synchronization shouldn't be a problem. On Linux, see ntp and /etc/ntp.conf
0
 
LVL 46

Expert Comment

by:Sjef Bosman
ID: 12367966
0
 
LVL 15

Expert Comment

by:Bozzie4
ID: 12368583
On Windows 2000, ntp protocol is also standard.  Use w32time and the Win 2000 time service counterpart (I forgot what it's called) to configure it.
On Windows NT, you'll have to download a tool to take care of time synchronization.

cheers,

Tom
0
 
LVL 31

Assisted Solution

by:qwaletee
qwaletee earned 125 total points
ID: 12373609
Turn on message tracking, shold make it easier to track down the message.  If you have R6, mail journaling can also help.  Make suret he two servers have synchronized clocks, so you can check the console log/misc events/mail routing events.
0
 
LVL 31

Expert Comment

by:qwaletee
ID: 12373886
What I also find interesting is that within 21 seconds of the two SMTP inbound messages arriving, there are four messages delievered -- two internally (Willy and Eva), and to back to the Symantec server.  Can you track down those messages?  The internal ines are pretty easy -- you will have the delivery times in the mail file,and you can match the end of the UNID to the message numbers.  The other two would involve comparing the information you provided here to the Symantec logs.

Also, log_mail_to_miscevents doesn't do much -- it just put the stuff that is already in Mail Routing Events in Misc Events.  You waant to increase the LEVEL of mail logging instead.

19.10.2004 15:28:06   SMTP Server: 62.176.195.177 disconnected. 1 message[s] received
19.10.2004 15:28:06   SMTP Server: 62.176.195.177 disconnected. 1 message[s] received
19.10.2004 15:28:12   Router: Message 0049FF4C delivered to Willy Wøllo/Narvik/Narvik kommune
19.10.2004 15:28:24   Router: Transferring mail to domain Spenst (host Spenst [62.176.195.177]) via SMTP
19.10.2004 15:28:26   Router: Message 0049E144 delivered to Eva Kristin Johnson/Narvik/Narvik kommune
19.10.2004 15:28:27   Router: Transferred 1 messages to Spenst (host Spenst) via SMTP
0
 

Author Comment

by:Millerjord
ID: 12374811
Hi Qwaletee.

First one question, how do I increase the level of mail logging??

About the mail routing log, as far as I can see from the different logs, one of the two mails received from the SMTP server in the DMZ at 15:28:06 is the one that have disappeared.

The internal mails might have come internally, it does not have to come from the SMTP server in the DMZ.

-:Rune:-
0
 
LVL 46

Accepted Solution

by:
Sjef Bosman earned 125 total points
ID: 12379173
Search your Admin Help db for "mail and level", you'll find a document called "Changing the logging level for mail": http://www-12.lotus.com/ldd/doc/domino_notes/Rnext/help6_admin.nsf/855dc7fcfd5fec9a85256b870069c0ab/7e98fb2a9a6834ca85256c1d003956cd?OpenDocument&Highlight=0,mail,level

To search other documents, see http://www-12.lotus.com/ldd/doc/domino_notes/Rnext/help6_admin.nsf/Main?OpenFrameSet

Did you manage to synchronize the clocks?
0
 

Author Comment

by:Millerjord
ID: 12384737
Hello everyone

I have managed to sync the clock, and to change the logging level for mail.

Now I just have to wait and see if some mail is missing, will check the log on monday.

Does anyone have an idea what I should look for?? As I mentioned, this is random!! An many users may have lost an email without knowing it!

Thanks to all of you, so far.

-:Rune:-
0
 
LVL 46

Expert Comment

by:Sjef Bosman
ID: 12385312
It's like looking at a black hole in the universe: you know it's there but you can see nothing. You could set up some service to send lots of mails, say every minute (marked), to your own address or a test-address. If you miss one, then start checking.

One more question: have any INTERNAL mails gone missing, or are only EXTERNAL mails (that passed the DMZ SMTP server) untraceable? By the way, do your internal users send SMTP-mails to the Domino-server directly?

I think we're in the same timezone (CET+1), so you've been at it quite late as well.

*Yawn* Bye for today!
0
 

Author Comment

by:Millerjord
ID: 12387674
Good Morning Sjef!

I know some Internal mails have disappeared as well, but not in quite a while. But at that time I just thought it was a user error.

But when the second and third mentioned missing mails, I started searching. But I couldn't find anything in the logs. Now I see much info in the logs, so I will think I can find something next time someone is missing a mail.

I will create an agent on my Notes client at home that sends mail to my test account every minute.

And by the way, no internal USERS send SMTP-mail to the Domino, but I have some applications and equipment that do!

-:Rune:-
0
 
LVL 31

Expert Comment

by:qwaletee
ID: 12390875
Don't forget to turn on MTC, as it is a spearate mail logging system with much greater detail.  (However, since it operates "at a distance" to the core logging facilities, it may not include info on teh missing messages... still, if it does, it will provide more info than the basic logging, no matter what level you tur it up to.)

Finally, if you have R6, you can tunr on mail journaling, so that you keep a copy of every message that passes through the router.
0
 

Author Comment

by:Millerjord
ID: 12421708
Hi everyone

Now I have come one step ahead.

First I want to remind you my Domino-server is running version 5.0.8!!

I have found I mail that is missing, and now I found it in the Notes-log too. And it looks like this:

27.10.2004 11:16:52   Router: Message 0032FB71 for CN=Bjørn Selnes/OU=Narvik/O=Narvik kommune deleted by mail rule filter
27.10.2004 11:16:52   Router: Message 0032FB71 delivered to Bjørn Selnes/Narvik/Narvik kommune from hans.skoglund@funn.no OF216F5057:807A26FA ONC1256F3A:0032FB71 Size: 5K Hop Count: 1

But as far as I know i don't have any mail rule filters. How can I set a mail rule filter?? And why does it say delivered?? It sure isn't delivered!!

Now I think we have come pretty near the bottom of this. HELP!!

-:Rune:-
0
 

Author Comment

by:Millerjord
ID: 12422533
Hi again.

I have searched the log for similar occurencies today, and I have found 10 deleted mails.

Please don't tell me this mail rule filter is implemented on the client mailbox, a setting the user have set himself!! If it is, somebody is going to lose their balls!!

The reason I ask this question is because the deleted mails are tried delivered to 2 different users, and both have implemented a pretty long list of rules to avoid spam manually. And as we all know, spam filters may eat a little more than they should.

Maybe the mystery is solved......

-:Rune:-
0
 
LVL 46

Expert Comment

by:Sjef Bosman
ID: 12423495
> Please don't tell me this mail rule filter is implemented on the client mailbox, a setting the user have set himself!! If it is, somebody is going to lose their balls!!

Make him go to the sperm bank first!

Most likely the mystery is solved :)
0
 
LVL 31

Expert Comment

by:qwaletee
ID: 12425028
I would say you've got it!

It would probably be better if instead of deleting, they moved such messages to a spam folder, so they could at least check what's moving through there once in a while.

I believe soft deletios would not help you here, because I think the rule deletes the document before it even arrives nto teh mail database, so it is not soft deleted, it is simply not delievered.  (The router says it was delivered, because it was handed off to the router dlievery code, and the logging is not that granular).
0

Featured Post

Announcing the Most Valuable Experts of 2016

MVEs are more concerned with the satisfaction of those they help than with the considerable points they can earn. They are the types of people you feel privileged to call colleagues. Join us in honoring this amazing group of Experts.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

IBM Notes offer Encryption feature using which the user can secure its NSF emails or entire database easily. In this section we will discuss about the process to Encrypt Incoming and Outgoing Mails in depth.
Article by: Rob
Notes 8.5 Archiving Steps and Tips This article covers setting up a Notes archive, and helps understand some of the menu choices making setting up and maintaining a Notes archive file easier.
I've attached the XLSM Excel spreadsheet I used in the video and also text files containing the macros used below. https://filedb.experts-exchange.com/incoming/2017/03_w12/1151775/Permutations.txt https://filedb.experts-exchange.com/incoming/201…
Are you ready to implement Active Directory best practices without reading 300+ pages? You're in luck. In this webinar hosted by Skyport Systems, you gain insight into Microsoft's latest comprehensive guide, with tips on the best and easiest way…

739 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question