Exchange 2003 SMTP queue keeps backing up

I have my Exchange 2003 bridgehead server talking to a Barracuda Spam Firewall 300 appliance for it's smart host. It hums along for a while and then all of a sudden gets a 'The connection was dropped by the remote host.' error and goes into retry mode. It retries the three times one minute appart, then waits 10 minutes for the fourth try which usually reconnects and flushes the queue. Barracuda claims there is nothing wrong on their end. Any ideas? Is there a log I can check to get more info as to what is going on with the Exchange server?

If I force a connection manually it seems to connect, change to active and flush the queue.

Thanks,
nocalertsAsked:
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

Brian BEE Topic Advisor, Independant Technology ProfessionalCommented:
When the problem is happening, can you telnet of port 25 from the Exchange server to the Barracuda? If not, the error that comes back may give us some help.

Also check the event logs on the Exchange server to see if there are any indications of a problem.
0
Shreedhar EtteCommented:
Hi,

I suspect the issue has been caused by the Barracuda Spam Firewall.

Bypass the Barracuda Spam Firewall and monitor the mail queue.

I hope this helps,
Shree
0
nocalertsAuthor Commented:
Can't do that because of the way my MX records are setup, won't survive a reverse look up. Barracuda suspects all is fine. Logs somewhere on the Exchange server maybe that would give more detail about the errors?
0
What were the top attacks of Q1 2018?

The Threat Lab team analyzes data from WatchGuard’s Firebox Feed, internal and partner threat intelligence, and a research honeynet, to provide insightful analysis about the top threats on the Internet. Check out our Q1 2018 report for smart, practical security advice today!

Brian BEE Topic Advisor, Independant Technology ProfessionalCommented:
Event viewer might give you some help, but you might have to increase the logging levels in Exchange.

The basic telnet test I mentioned might at least tell us where to start looking.
0
nocalertsAuthor Commented:
PS...I can telnet fine, issue is intermittent.
0
DMTechGrooupCommented:
http://www.msexchange.org/tutorials/Logging_the_SMTP_Service.html

http://support.microsoft.com/kb/821910



Turn your logging on and then look at the logs to see what is going on with the connection.  Is the smart host using a FQDN or an IP address?

0
nocalertsAuthor Commented:
Thanks, I've enabled the logging, I talk to the smart host by IP address.

Miles
0
nocalertsAuthor Commented:
Might be a stupid question, but in the Microsoft KB it talks about enabling the diagnostic logging, but no info on where to read them. I assume this just logs to the Windows Application Event Log then?
0
DMTechGrooupCommented:
Diag logging is in the event viewer.. the smtp creates its own text file logs.
0
nocalertsAuthor Commented:
figured...thanks, already found this which does point to the Spam filter even though they swore it was not...

Message delivery to the host '10.5.1.160' failed while delivering to the remote domain  '[10.5.1.160]' for the following reason: An SMTP protocol error occurred.
 The SMTP verb which caused the error is 'MAIL'.  The response from the remote server is '421 Error: too many messages in one session
'.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
nocalertsAuthor Commented:
OK, added my server to the exception for the rate limiting and mail seems to flow right away now...so that was the core of my problem. Still seeing these however:

Event Type:      Warning
Event Source:      MSExchangeTransport
Event Category:      Routing Engine/Service
Event ID:      952
Date:            4/13/2010
Time:            5:23:14 AM
User:            N/A
Computer:      GMBEXFEND01
Description:
Subordinate routing node failed to connect to its master

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 4c 27 00 00               L'..    

Miles
0
nocalertsAuthor Commented:
Also seeing this, which concerns me:

Event Type:      Error
Event Source:      Userenv
Event Category:      None
Event ID:      1006
Date:            4/13/2010
Time:            9:40:31 AM
User:            GBR_NT\PMarchand
Computer:      GMBEXFEND01
Description:
Windows cannot bind to GMI-BOSTON.COM domain. (Invalid Credentials). Group Policy processing aborted.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
0
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Email Protocols

From novice to tech pro — start learning today.