?
Solved

Exchange 2003 SMTP queue keeps backing up

Posted on 2010-04-01
15
Medium Priority
?
1,152 Views
Last Modified: 2013-11-30
I have my Exchange 2003 bridgehead server talking to a Barracuda Spam Firewall 300 appliance for it's smart host. It hums along for a while and then all of a sudden gets a 'The connection was dropped by the remote host.' error and goes into retry mode. It retries the three times one minute appart, then waits 10 minutes for the fourth try which usually reconnects and flushes the queue. Barracuda claims there is nothing wrong on their end. Any ideas? Is there a log I can check to get more info as to what is going on with the Exchange server?

If I force a connection manually it seems to connect, change to active and flush the queue.

Thanks,
0
Comment
Question by:nocalerts
  • 7
  • 3
  • 2
  • +1
13 Comments
 
LVL 26

Expert Comment

by:Brian B
ID: 29369714
When the problem is happening, can you telnet of port 25 from the Exchange server to the Barracuda? If not, the error that comes back may give us some help.

Also check the event logs on the Exchange server to see if there are any indications of a problem.
0
 
LVL 34

Expert Comment

by:Shreedhar Ette
ID: 29375045
Hi,

I suspect the issue has been caused by the Barracuda Spam Firewall.

Bypass the Barracuda Spam Firewall and monitor the mail queue.

I hope this helps,
Shree
0
 

Author Comment

by:nocalerts
ID: 29375193
Can't do that because of the way my MX records are setup, won't survive a reverse look up. Barracuda suspects all is fine. Logs somewhere on the Exchange server maybe that would give more detail about the errors?
0
SMB Security Just Got a Layer Stronger

WatchGuard acquires Percipient Networks to extend protection to the DNS layer, further increasing the value of Total Security Suite.  Learn more about what this means for you and how you can improve your security with WatchGuard today!

 
LVL 26

Expert Comment

by:Brian B
ID: 29913625
Event viewer might give you some help, but you might have to increase the logging levels in Exchange.

The basic telnet test I mentioned might at least tell us where to start looking.
0
 

Author Comment

by:nocalerts
ID: 30222822
PS...I can telnet fine, issue is intermittent.
0
 
LVL 24

Expert Comment

by:DMTechGrooup
ID: 30538386
http://www.msexchange.org/tutorials/Logging_the_SMTP_Service.html

http://support.microsoft.com/kb/821910



Turn your logging on and then look at the logs to see what is going on with the connection.  Is the smart host using a FQDN or an IP address?

0
 

Author Comment

by:nocalerts
ID: 30540808
Thanks, I've enabled the logging, I talk to the smart host by IP address.

Miles
0
 

Author Comment

by:nocalerts
ID: 30541352
Might be a stupid question, but in the Microsoft KB it talks about enabling the diagnostic logging, but no info on where to read them. I assume this just logs to the Windows Application Event Log then?
0
 
LVL 24

Expert Comment

by:DMTechGrooup
ID: 30541721
Diag logging is in the event viewer.. the smtp creates its own text file logs.
0
 

Author Comment

by:nocalerts
ID: 30542488
figured...thanks, already found this which does point to the Spam filter even though they swore it was not...

Message delivery to the host '10.5.1.160' failed while delivering to the remote domain  '[10.5.1.160]' for the following reason: An SMTP protocol error occurred.
 The SMTP verb which caused the error is 'MAIL'.  The response from the remote server is '421 Error: too many messages in one session
'.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
0
 
LVL 24

Accepted Solution

by:
DMTechGrooup earned 2000 total points
ID: 30542714
0
 

Author Comment

by:nocalerts
ID: 30616289
OK, added my server to the exception for the rate limiting and mail seems to flow right away now...so that was the core of my problem. Still seeing these however:

Event Type:      Warning
Event Source:      MSExchangeTransport
Event Category:      Routing Engine/Service
Event ID:      952
Date:            4/13/2010
Time:            5:23:14 AM
User:            N/A
Computer:      GMBEXFEND01
Description:
Subordinate routing node failed to connect to its master

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 4c 27 00 00               L'..    

Miles
0
 

Author Comment

by:nocalerts
ID: 30620736
Also seeing this, which concerns me:

Event Type:      Error
Event Source:      Userenv
Event Category:      None
Event ID:      1006
Date:            4/13/2010
Time:            9:40:31 AM
User:            GBR_NT\PMarchand
Computer:      GMBEXFEND01
Description:
Windows cannot bind to GMI-BOSTON.COM domain. (Invalid Credentials). Group Policy processing aborted.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
0

Featured Post

Keep up with what's happening at Experts Exchange!

Sign up to receive Decoded, a new monthly digest with product updates, feature release info, continuing education opportunities, and more.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Upgrading from older Exchange server to the latest Exchange server can be tiresome, error-prone and risky, without being a seasoned exchange server administrators. It can become even problematic if you're an organization that runs on tight timeline…
This article explains how to move an Exchange 2013/2016 mailbox database and logs to a different drive.
There are cases when e.g. an IT administrator wants to have full access and view into selected mailboxes on Exchange server, directly from his own email account in Outlook or Outlook Web Access. This proves useful when for example administrator want…
This video tutorial shows you the steps to go through to set up what I believe to be the best email app on the android platform to read Exchange mail.  Get the app on your phone: The first step is to make sure you have the Samsung Email app on your …

588 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question