Old email appears in smtp queues after Exchange reboot

We rebooted our Exchange server (Exchange 2003 SP2) after installing MS security updates. When the server came back up there were over 50 email messages in SMTP queue.  Each had varying dates, and some dated back to the last time the server was rebooted (almost 2 months ago). All of the message recipients I looked at in the SMTP queues were from other domains (yahoo, gmail, etc.)

The Exchange server uses an SMTP connector, which happens to be our Barracuda anti-spam appliance. I have been administering the Exchange server for several months and haven't seen any messages lingering in the queues for more than 20 minutes, nor have I ever rebooted the server and then had mail flow, especially from two months ago.

I also have checked the Badmail folder and the Exchange Anti-Virus quarantine, I didn't see any of the messages that got sent out after the reboot.

There must be a folder I'm missing on the Exchange server that held these messages. When the Exchange server was rebooted on Friday, a brick level backup was running. I thought that perhaps the back up job being cut off like that may have explained why the messages suddenly appeared and went out. However, a user reported today that a message they sent last month  arrived to it's intended recpipients last Friday night.

Experts, help!
lucado01Asked:
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

Erik PittiCommented:
Perhaps the messages ended up in the queue or pickup folder after the reboot.

See here for Exchange SMTP special folders:
http://support.microsoft.com/kb/306043
0
SembeeCommented:
Not unusual for this to happen.
The most common reason is that antivirus software has hung on to the messages and it is only when the services are restarted by a reboot that they are released.

Simon.
0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
lucado01Author Commented:
I am fairly certain the messages weren't in those folders.

Regarding the anti-virus, is this something I should be able to spot in the program's quarantine field and release it? Would it be held anywhere else? Would the vendor (Symantec) admit to this?
0
Erik PittiCommented:
Sembee: Thats kinda the direction I was heading.  

Lucado01: I've seen Trend's AV do this as well, esp after a clustered Exchange server failover.  But I'm sure it could also happen after a reboot.  Probably no big deal.  You may want to contact your AV vendor and ask if there's an update available that will curb the behavior.
0
SembeeCommented:
Depends where the software is holding the message and which one is holding it. It is not unusual for a message to just disappear only to reappear when the server is rebooted.

Simon.
0
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Exchange

From novice to tech pro — start learning today.