Solved

Messages recieved (viewed or not) disappeared

Posted on 2008-06-23
10
271 Views
Last Modified: 2008-07-03
Messages recieved (viewed or not) disappeared for several users
 - 2003 server restarted
 - OWA checked
 - Outlook NOT using cached mode
 - Outlook client profile recreated
 - mailbox moved to another server
 - messages still missing
 - suggestions?
0
Comment
Question by:D_Hill
  • 4
  • 3
  • 3
10 Comments
 
LVL 3

Expert Comment

by:Rikketyrik
Comment Utility
Could they have "accidently" created some rules that are moving the messages? Rules will follow mailbox moves and profile recreations.
0
 
LVL 4

Expert Comment

by:antioed
Comment Utility
Also check the Junk Mail Filter settings...if it is set to delete suspected junk, this problem can occur.  Took me some time to figure it out because the store will show it as submitted for local delivery, the user does not have any rules set but the messages just disappear with no way to recover!  Very dangerous setting!
0
 
LVL 4

Expert Comment

by:antioed
Comment Utility
I should clarify that I am talking about junk mail settings in the Outlook client itself...not on the server!
0
 

Author Comment

by:D_Hill
Comment Utility
As previously stated:
 - OWA checked
 - Outlook NOT using cached mode
 - Outlook client profile recreated
 - mailbox moved to another server
 - messages still missing
ALSO
 - junk mail filter disabled both in OWA & Outlook
...appears to be on the exchange side as several users were affected
0
 
LVL 3

Expert Comment

by:Rikketyrik
Comment Utility
I would double check the rules if for nothing more that giggles, and to rule it out. It has burned me in the past as well as some strange filters.

How did you confirm that the mails were actually being delivered?
Have you searched the mailbox?
0
Enabling OSINT in Activity Based Intelligence

Activity based intelligence (ABI) requires access to all available sources of data. Recorded Future allows analysts to observe structured data on the open, deep, and dark web.

 

Author Comment

by:D_Hill
Comment Utility
As exchange manager I have access to both sides of the equation and have checked all the obvious
0
 
LVL 4

Expert Comment

by:antioed
Comment Utility
Are you using some sort of spam-blocking feature antivirus type of thing on the Outlook client?  All it takes is a user having a home machine or being logged in at some machine somewhere with a client set up with that Junk email setting checked.  I once had a user with a machine at home connected to VPN...turned out to have that Junk Mail setting on which was causing this rather perplexing behavior...of course their workstation in the office had the right setting so I could not figure it out and thought it was something in Exchange.  In that case I could track the messages in "Message Tracking" and see the messages submitted for local delivery to the user's mail...then the messages would just simply disappear without a trace once the local rule/setting on the client swept the local version of the inbox.  

 Why do you think it is an "Exchange" issue?  Some sort of UCE filter such as the Intelligent Message Filter from Microsoft could cause messages  to be "filtered" and *not* delivered but if the messages made it to the user's mailbox then it's likely *NOT* a server-side/Exchange issue.  I know it is tempting to think that...but you would be looking at some sort of very serious system problem or very bad security incident otherwise...that's likely *not* the case!  

If you know a sender for one of the messages that was "lost" then search for it in Message Tracking...if the message was submitted for local delivery, which it pretty much had to have been to if it showed up in the user mailbox at all, it would be nearly impossible for this *not* to be a rule/client issue of some sort.  Generally the Exchange/Server type filtering that could cause messages not to arrive would occur long before the messages make it to the user's inbox.  
0
 
LVL 3

Expert Comment

by:Rikketyrik
Comment Utility
Another idea along Antioed's line of thought is that a home/VPN user could have the mail setup wrong so that it is sending the mail to a PST file.
0
 

Author Comment

by:D_Hill
Comment Utility
nothing helpful yet ... background
- Exchange server reset Thur. afternoon June 19 - all appears to have recovered...
- FRISK - F-Prot 2.0.2 for exchange seems to cause virtual memory errors that eventually crash exchange unless the server is restarted routinely
- restart yesterday 08:10 - exchange services and stores appear to return to normal by 08:15 (usual time for bootup)
- as soon as users begin accessing their outlook, reports of messages disappearing begin
- several application log errors occur (Im hppy to post any logs requested):
6/23/2008      8:46:22 AM      POP3SVC      Error      Content Engine       1023
6/23/2008      8:43:54 AM      POP3SVC      Error      Content Engine       1023
6/23/2008      8:43:51 AM      POP3SVC      Error      Content Engine       1023
6/23/2008      8:43:51 AM      POP3SVC      Error      Content Engine       1023
6/23/2008      8:43:49 AM      MSExchangeIS Mailbox Store      Warning      Views       1173
6/23/2008      8:43:47 AM      MSExchangeIS Mailbox Store      Warning      Views       1173
6/23/2008      8:36:59 AM      EXCDO      Warning      General       8231
6/23/2008      8:36:58 AM      EXCDO      Warning      General       8231
6/23/2008      8:36:47 AM      EXCDO      Error      General       8255
6/23/2008      8:36:47 AM      MSExchangeIS Mailbox Store      Error      Logons       1022
6/23/2008      8:36:47 AM      EXCDO      Warning      General       8231
6/23/2008      8:36:46 AM      EXCDO      Error      General       8255
6/23/2008      8:36:46 AM      MSExchangeIS Mailbox Store      Error      Logons       1022
6/23/2008      8:36:46 AM      EXCDO      Warning      General       8231
6/23/2008      8:32:51 AM      EXCDO      Error      General       8255
6/23/2008      8:32:51 AM      MSExchangeIS Mailbox Store      Error      Logons       1022
6/23/2008      8:32:51 AM      EXCDO      Warning      General       8231
6/23/2008      8:32:50 AM      EXCDO      Warning      General       8231
-----
- removed F-Prot and restarted exchange (during this period the following error was also received):
Event Type:      Error
Event Source:      Microsoft Exchange Server
Event Category:      None
Event ID:      1000
Date:            6/23/2008
Time:            8:49:53 AM
User:            N/A
Computer:      NORTH-DC-002
Description:
The description for Event ID ( 1000 ) in Source ( Microsoft Exchange Server ) cannot be found. The local computer may not have the necessary registry information or message DLL files to display messages from a remote computer. You may be able to use the /AUXSOURCE= flag to retrieve this description; see Help and Support for details. The following information is part of the event: store.exe, 6.5.7652.24, 46152f9f, reapi.dll, 6.5.7638.1, 430e8138, 0, 0002c599.
Data:
0000: 41 00 70 00 70 00 6c 00   A.p.p.l.
0008: 69 00 63 00 61 00 74 00   i.c.a.t.
0010: 69 00 6f 00 6e 00 20 00   i.o.n. .
0018: 46 00 61 00 69 00 6c 00   F.a.i.l.
0020: 75 00 72 00 65 00 20 00   u.r.e. .
0028: 20 00 73 00 74 00 6f 00    .s.t.o.
0030: 72 00 65 00 2e 00 65 00   r.e...e.
0038: 78 00 65 00 20 00 36 00   x.e. .6.
0040: 2e 00 35 00 2e 00 37 00   ..5...7.
0048: 36 00 35 00 32 00 2e 00   6.5.2...
0050: 32 00 34 00 20 00 34 00   2.4. .4.
0058: 36 00 31 00 35 00 32 00   6.1.5.2.
0060: 66 00 39 00 66 00 20 00   f.9.f. .
0068: 69 00 6e 00 20 00 72 00   i.n. .r.
0070: 65 00 61 00 70 00 69 00   e.a.p.i.
0078: 2e 00 64 00 6c 00 6c 00   ..d.l.l.
0080: 20 00 36 00 2e 00 35 00    .6...5.
0088: 2e 00 37 00 36 00 33 00   ..7.6.3.
0090: 38 00 2e 00 31 00 20 00   8...1. .
0098: 34 00 33 00 30 00 65 00   4.3.0.e.
00a0: 38 00 31 00 33 00 38 00   8.1.3.8.
00a8: 20 00 66 00 44 00 65 00    .f.D.e.
00b0: 62 00 75 00 67 00 20 00   b.u.g. .
00b8: 30 00 20 00 61 00 74 00   0. .a.t.
00c0: 20 00 6f 00 66 00 66 00    .o.f.f.
00c8: 73 00 65 00 74 00 20 00   s.e.t. .
00d0: 30 00 30 00 30 00 32 00   0.0.0.2.
00d8: 63 00 35 00 39 00 39 00   c.5.9.9.
00e0: 0d 00 0a 00               ....    
-----
0
 

Accepted Solution

by:
D_Hill earned 0 total points
Comment Utility
After extensive searching it appears the "disappearing email messages" issue
can be attributed to conflicting virus scanners (internal and external) on
the server.
0

Featured Post

Better Security Awareness With Threat Intelligence

See how one of the leading financial services organizations uses Recorded Future as part of a holistic threat intelligence program to promote security awareness and proactively and efficiently identify threats.

Join & Write a Comment

Suggested Solutions

ADCs have gained traction within the last decade, largely due to increased demand for legacy load balancing appliances to handle more advanced application delivery requirements and improve application performance.
This process describes the steps required to Import and Export data from and to .pst files using Exchange 2010. We can use these steps to export data from a user to a .pst file, import data back to the same or a different user, or even import data t…
This tutorial will walk an individual through the process of transferring the five major, necessary Active Directory Roles, commonly referred to as the FSMO roles to another domain controller. Log onto the new domain controller with a user account t…
how to add IIS SMTP to handle application/Scanner relays into office 365.

763 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

11 Experts available now in Live!

Get 1:1 Help Now