• Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 1529
  • Last Modified:

SMTP Server Remote Queue Length Alert

I receive server alerts related to SMTP que length, a large number of messages are pending in the send que.  I have heard that if the server is an open relay, the que will grow quickly and can crash the server?  There are intermittent crashes that occur every several weeks.
What do you recommend for troubleshooting a large number of messages are pending in the e-mail server send queue.
0
AE_JB
Asked:
AE_JB
  • 10
  • 4
  • 3
6 Solutions
 
Manpreet SIngh KhatraSolutions Architect, Project LeadCommented:
Firstly check if you have set Open relay on the SMTP Virtual server or SMTP connector if you have any ?

Simply check the below Articles and try to work/check stuff

SMTP Server Remote Queue Length Alert on SBS
http://blog.mpecsinc.ca/2008/02/smtp-server-remote-queue-length-alert.html

SMTP Server Remote Queue Length Alert
http://www.winserverkb.com/Uwe/Forum.aspx/exchange-admin/32052/SMTP-Server-Remote-Queue-Length-Alert

SMTP Server Remote Queue Length Alert
http://www.experts-exchange.com/Software/Server_Software/Email_Servers/Exchange/Q_23092398.html

SMTP Server Remote Queue Length Alert on SBS
http://www.experts-exchange.com/Software/Server_Software/Email_Servers/Exchange/Q_25201542.html

- Rancy
0
 
MidnightOneCommented:
First, I recommend you have some form of real-time monitoring and notification in play. At my workplace we're using Opsview Core and have it set to warn us is there's more than 25 messages in queue.

As far as troubleshooting, head out to http://mxtoolbox.com and run their diagnostics to determine if you're an open relay.

In my experience, most server floods are from our users having compromised clients when they use their personal email as a destination for company email - and end up carpet-bombing the company email servers.
0
 
AE_JBAuthor Commented:
They do not have open relay.  They are currently on Backscatter blacklist.  I am checking the links in Rancy's post.
0
Making Bulk Changes to Active Directory

Watch this video to see how easy it is to make mass changes to Active Directory from an external text file without using complicated scripts.

 
AE_JBAuthor Commented:
Can the SMTP que length effect users ability to send email?  Also, if the que grows too quickly, can this use system resources and crash the server?  There have been unexpected shutdowns.
0
 
AE_JBAuthor Commented:
Is Exchange Management pack a reccommended monitoring tool for SBS 2003?
http://www.microsoft.com/en-us/download/details.aspx?id=17632
0
 
Manpreet SIngh KhatraSolutions Architect, Project LeadCommented:
Can the SMTP que length effect users ability to send email? - The emails would Queue in as FIFO so if its behind many a emails it will wait for the first in to be delivered to processed by the server.

Also, if the que grows too quickly, can this use system resources and crash the server? - Cant say until its more like a Storm of thousands and thousands of emails. But no user can do this so need to check if this is some Application server or Spam.

I dont think i have ever used this tool so cant say :(

- Rancy
0
 
MidnightOneCommented:
Absolutely it can. We routinely get carpet-bombed by our own users with large attachments  of their vacation photos and other "business related" things. Last time someone did this mail delays peaked at thirty minutes.

If the queues grow too quickly, it can run out drive space two ways: With the items in queue as well the transaction logs.

Your best protection is real-time monitoring. If the queues start storming, you can turn off SMTP to keep it from getting worse and allow you to determine if the source is internal or external.
0
 
AE_JBAuthor Commented:
I turned off NDR and still receive alerts about the que length.  Is a restart required for the changes to take effect?  There is no mention of restart in the Microsoft KB artical.
Could error 9646 be related?  I receive the following alert about a user who seems to be generating excessive traffic:
Mapi session "/o=ACME/ou=first administrative group/cn=Recipients/cn=jsmith" exceeded the maximum of 32 objects of type "session".
0
 
AE_JBAuthor Commented:
I also checked the SMTP que in Exchange System Manager,
DOMAIN-->Servers-->SERVERNAME-->Queues
There are at least 20 Small Business SMTP connectors, most appear to be non professional domains, and many have items in the que, can I delete these connectors?
0
 
AE_JBAuthor Commented:
Looking at the server usage report, it appears that the Administrator account is sending out thousands of emails
0
 
MidnightOneCommented:
I would suggest resetting the admin password and seeing if the behavior continues.
0
 
AE_JBAuthor Commented:
Changing the admin password is not an option...what else do you recommend?
0
 
Manpreet SIngh KhatraSolutions Architect, Project LeadCommented:
Is the Blacklisting removed ?
DId you happen to see any unwanted emails flowing ... better to check with Message Tracking and see if we see any External email trying to relay.

- Rancy
0
 
AE_JBAuthor Commented:
The blacklisting is removed, however, I have received SMTP que alerts every few hours for the past day.
Am looking into how to use message tracking.
0
 
AE_JBAuthor Commented:
The server usage report shows a large number of emails being sent from the Administrator account, however, there are no emails in that users 'Sent' folder.  Still need to check message tracking.
0
 
Manpreet SIngh KhatraSolutions Architect, Project LeadCommented:
look if you have set some Policy or reporting that will use that email.

- Rancy
0
 
AE_JBAuthor Commented:
I do not see one directly related to outgoing administrator emails.
0

Featured Post

Fill in the form and get your FREE NFR key NOW!

Veeam is happy to provide a FREE NFR server license to certified engineers, trainers, and bloggers.  It allows for the non‑production use of Veeam Agent for Microsoft Windows. This license is valid for five workstations and two servers.

  • 10
  • 4
  • 3
Tackle projects and never again get stuck behind a technical roadblock.
Join Now