RE: Disappearing Emails

Hello Sam,

Thank you for kind update.

After analyze your SMTP log, the 3 emails have received your exchange
server, if you make sure you did not receive 2 of them, we need to track
the emails in exchange server.

1. Please do clean boot to make sure there is no 3rd-party software refer
to this issue. Meanwhile, try to disable Antivirus software and spam filter
software on your exchange server.

To clean boot the server, please use the steps below:

a. Click Start, click Run, and then in the Open box, type "MSCONFIG"
(without the quotation marks). Click OK.

b. In the System Configuration Utility (MSConfig) window, click to select
the Selective Startup button.

c. Click to clear the check mark from the "Load startup items" below
Selective Startup.

d. Click the Services tab, click to check the "Hide All Microsoft Services"
box, and remove all the check marks from the remained Non-Microsoft
Services. Please note that the Exchange services could be marked as
non-Microsoft. Please do not disable those services.

e. Click OK to close the MSConfig window. Click Yes when you are asked to
restart your computer in order to enable the changes.

f. After restarting, please check whether this issue will reoccur.

If it reoccurs, please kindly help me collect some information for further
investigation:

1. Please go to Message Tracking Center and track the following 3 test
mails, then capture 3 screenshots on the outcome and send the pictures to
me at v-terliu@xxxxxxxxxxxxx

Note: please take care of the time.
=================
2006-12-18 14:25:47 217.114.173.81 av.blacknight.ie SMTPSVC1 192.168.2.1 0
EHLO - +av.blacknight.ie 250 0 310 21 0 SMTP - - - -
2006-12-18 14:25:47 217.114.173.81 av.blacknight.ie SMTPSVC1 192.168.2.1 0
MAIL - +From:<Mary.Dunleavy@xxxxxxxxxx> 250 0 49 55 0 SMTP - - - -
2006-12-18 14:25:47 217.114.173.81 av.blacknight.ie SMTPSVC1 192.168.2.1 0
RCPT - +To:<PHannigan@xxxxxxxxxxxxxxxx> 250 0 39 57 0 SMTP - - - -
2006-12-18 14:25:48 217.114.173.81 av.blacknight.ie SMTPSVC1 192.168.2.1 0
DATA - +<096586A6F34AFF4286CF3940F8409CDFBC4D1E@msw2kba01> 250 0 134 5871
203 SMTP - - - -
2006-12-18 14:25:48 217.114.173.81 av.blacknight.ie SMTPSVC1 192.168.2.1 0
QUIT - av.blacknight.ie 240 1015 65 4 0 SMTP - - - -
2006-12-18 14:27:08 217.114.173.81 av.blacknight.ie SMTPSVC1 192.168.2.1 0
EHLO - +av.blacknight.ie 250 0 310 21 0 SMTP - - - -


SMTP - - - -
2006-12-18 16:40:07 217.114.173.81 av.blacknight.ie SMTPSVC1 192.168.2.1 0
MAIL - +From:<Mary.Dunleavy@xxxxxxxxxx> 250 0 49 48 0 SMTP - - - -
2006-12-18 16:40:07 217.114.173.81 av.blacknight.ie SMTPSVC1 192.168.2.1 0
RCPT - +To:<PHannigan@xxxxxxxxxxxxxxxx> 250 0 39 57 0 SMTP - - - -
2006-12-18 16:40:09 217.114.173.81 av.blacknight.ie SMTPSVC1 192.168.2.1 0
DATA - +<096586A6F34AFF4286CF3940F8409CDFBC4D22@msw2kba01> 250 0 134 309953
2266 SMTP - - - -
2006-12-18 16:40:09 217.114.173.81 av.blacknight.ie SMTPSVC1 192.168.2.1 0
QUIT - av.blacknight.ie 240 2875 65 4 0 SMTP - - - -
2006-12-18 16:41:11 217.114.173.81 av.blacknight.ie SMTPSVC1 192.168.2.1 0
EHLO - +av.blacknight.ie 250 0 310 21 0 SMTP - - - -
2006-12-18 16:41:11 217.114.173.81 av.blacknight.ie SMTPSVC1 192.168.2.1 0
MAIL -



+<1101487879746.1101310754536.7613.6.2211552D@scheduler> 250 0 139 27735
969 SMTP - - - -
2006-12-18 17:08:44 217.114.173.81 av.blacknight.ie SMTPSVC1 192.168.2.1 0
QUIT - av.blacknight.ie 240 2031 65 4 0 SMTP - - - -
2006-12-18 17:10:29 217.114.173.81 av.blacknight.ie SMTPSVC1 192.168.2.1 0
EHLO - +av.blacknight.ie 250 0 310 21 0 SMTP - - - -
2006-12-18 17:10:29 217.114.173.81 av.blacknight.ie SMTPSVC1 192.168.2.1 0
MAIL - +From:<Mary.Dunleavy@xxxxxxxxxx> 250 0 49 55 0 SMTP - - - -
2006-12-18 17:10:29 217.114.173.81 av.blacknight.ie SMTPSVC1 192.168.2.1 0
RCPT - +To:<PHannigan@xxxxxxxxxxxxxxxx> 250 0 39 57 0 SMTP - - - -
2006-12-18 17:10:29 217.114.173.81 av.blacknight.ie SMTPSVC1 192.168.2.1 0
DATA - +<096586A6F34AFF4286CF3940F8409CDFBC4D2E@msw2kba01> 250 0 134 5800
203 SMTP - - - -
=================
a. Start Exchange System Manager.
b. In the console tree, expand Tools, and then click Message Tracking
Center.
c. In the Server box, type the name of the server that is running Exchange
2000 Server or Exchange Server 2003.

To see an available server, follow these steps:
a. Expand the Message Tracking Center node in Exchange System Manager.
b. Type a server name in the Server box, and then click Find Now.

2. Save the application event log and system event log as evt files on the
problematic machines and send to my mailbox: v-terliu@xxxxxxxxxxxxx

Hope these steps will give you some help.

Thanks and have a nice day!

Best regards,

Terence Liu(MSFT)

Microsoft CSS Online Newsgroup Support

Get Secure! - www.microsoft.com/security

=====================================================
This newsgroup only focuses on SBS technical issues. If you have issues
regarding other Microsoft products, you'd better post in the corresponding
newsgroups so that they can be resolved in an efficient and timely manner.
You can locate the newsgroup here:
http://www.microsoft.com/communities/newsgroups/en-us/default.aspx

When opening a new thread via the web interface, we recommend you check the
"Notify me of replies" box to receive e-mail notifications when there are
any updates in your thread. When responding to posts via your newsreader,
please "Reply to Group" so that others may learn and benefit from your
issue.

Microsoft engineers can only focus on one issue per thread. Although we
provide other information for your reference, we recommend you post
different incidents in different threads to keep the thread clean. In doing
so, it will ensure your issues are resolved in a timely manner.

For urgent issues, you may want to contact Microsoft CSS directly. Please
check http://support.microsoft.com for regional support phone numbers.

Any input or comments in this thread are highly appreciated.
=====================================================

This posting is provided "AS IS" with no warranties, and confers no rights.

--------------------
| Thread-Topic: Disappearing Emails
| thread-index: AccjX+cnsptoy7BqQ+OGVQsi9zmuJQ==
| X-WBNR-Posting-Host: 80.249.248.9
| From: =?Utf-8?B?U2Ft?= <Sam@xxxxxxxxxxxxxxxxxxxxxxxxx>
| References: <6B327B1E-A025-46EC-A4F6-4CB56D1EEA12@xxxxxxxxxxxxx>
<PwDglfCIHHA.2024@xxxxxxxxxxxxxxxxxxxxxx>
<990EBB04-EE0C-4FD2-ADFC-F4E16FD1A5CA@xxxxxxxxxxxxx>
<fN37JcqIHHA.2300@xxxxxxxxxxxxxxxxxxxxxx>
| Subject: RE: Disappearing Emails
| Date: Tue, 19 Dec 2006 03:22:01 -0800
| Lines: 334
| Message-ID: <DA94230E-1714-4E53-BC2B-A957FF974C0C@xxxxxxxxxxxxx>
| MIME-Version: 1.0
| Content-Type: text/plain;
| charset="Utf-8"
| Content-Transfer-Encoding: 8bit
| X-Newsreader: Microsoft CDO for Windows 2000
| Content-Class: urn:content-classes:message
| Importance: normal
| Priority: normal
| X-MimeOLE: Produced By Microsoft MimeOLE V6.00.3790.2757
| Newsgroups: microsoft.public.windows.server.sbs
| Path: TK2MSFTNGHUB02.phx.gbl
| Xref: TK2MSFTNGHUB02.phx.gbl microsoft.public.windows.server.sbs:5283
| NNTP-Posting-Host: tk2msftsbfm01.phx.gbl 10.40.244.148
| X-Tomcat-NG: microsoft.public.windows.server.sbs
|
| Hi Terence,
|
| I enabled the logging so I will send you a section of it that is relevant
to
| the issue.
| In the log you will see 3 emails. Only the last one reached the recipient.
|
| Generally emails are coming in & out OK. But then a user will ring me
| stating that they are waiting for an email but not receiving it. Only the
| resent email will turn up never the original!
|
| 1. As I say emails are coming in & out so telnet may not prove anything.
|
| 2. The old domain is not really used anymore and the issue only happens
from
| time to time so itâ??s hard to replicate the issue. Only when I get a
call do I
| know there is a missing email.
|
| 3. I have had reports from a number of users. Not all, but they may not
| realize mails are missing!
|
| 4. Problematic email address receives emails during the normal run of the
| day then I get call "mail missing".
|
| 5. I will send log of missing mail example.
|
| More info:
| There are a number of remote users connecting to the server through
| HTTPS, OWA & POP3
|
| Thank you for your time I look forward to hearing from you.
| Sam
|
|
| "Terence Liu [MSFT]" wrote:
|
| > Hello Sam,
| >
| > Thank you for kind update.
| >
| > This is a receive email issue. We have to know the more info about the
| > lost email. And it may cost long time to troubleshooting this problem.
| >
| > Let narrow down this issue from the following question:
| >
| > 1. Please let me know the two domains' names, I will do telnet test.
| >
| > 2. The lost emails are sent to one of the two domains of both of the
two?
| >
| > 3. The lost emails are sent to individual accounts or all user accounts
| > have the same issue?
| >
| > 4. Please let me know a problematic email address and I want to send a
test
| > mail to your mailbox.
| >
| > 5. Try to use an external mailbox to send a test mail to your internal
| > accounts and then gather SMTP log
| >
| > A. Open Exchange System Manager, expand Servers -> <Server name> ->
| > Protocols -> SMTP, right-click "Default SMTP Virtual Server" and click
| > Properties.
| >
| > B. Under the General tab, check the option "Enable Logging".
| >
| > C. With "W3C Extended Log File Format", click "Properties".
| >
| > D. Under "General Properties", make sure "Use local time for file
naming
| > and rollover" is CHECKED.
| >
| > E. Switch to the "Extended Properties", and then select to enable All
the
| > logging Options.
| >
| > F. Click OK to apply the modification.
| >
| > G. Right-click Default SMTP Virtual Server and click Stop.
| >
| > H. Right-click Default SMTP Virtual Server and click Start to restart
the
| > SMTP server.
| >
| > I. Reproduce the issue, send a test email from external, then repeat
step G
| > to stop Default SMTP Virtual Server, copy out or zip the SMTP log files
in
| > the "%systemroot%\system32\logfiles\SmtpSvc1" folder, and then restart
the
| > "Default SMTP Virtual Server".
| >
| > J. Please send the zip file to me at v-terliu@xxxxxxxxxxxxx and let me
know
| > the test mail's sender, receiver and subject and send time.
| >
| > I appreciate your time and look forward to hearing from you.
| >
| > Thanks and have a nice day!
| >
| > Best regards,
| >
| > Terence Liu(MSFT)
| >
| > Microsoft CSS Online Newsgroup Support
| >
| > Get Secure! - www.microsoft.com/security
| >
| > =====================================================
| > This newsgroup only focuses on SBS technical issues. If you have issues
| > regarding other Microsoft products, you'd better post in the
corresponding
| > newsgroups so that they can be resolved in an efficient and timely
manner.
| > You can locate the newsgroup here:
| > http://www.microsoft.com/communities/newsgroups/en-us/default.aspx
| >
| > When opening a new thread via the web interface, we recommend you check
the
| > "Notify me of replies" box to receive e-mail notifications when there
are
| > any updates in your thread. When responding to posts via your
newsreader,
| > please "Reply to Group" so that others may learn and benefit from your
| > issue.
| >
| > Microsoft engineers can only focus on one issue per thread. Although we
| > provide other information for your reference, we recommend you post
| > different incidents in different threads to keep the thread clean. In
doing
| > so, it will ensure your issues are resolved in a timely manner.
| >
| > For urgent issues, you may want to contact Microsoft CSS directly.
Please
| > check http://support.microsoft.com for regional support phone numbers.
| >
| > Any input or comments in this thread are highly appreciated.
| > =====================================================
| >
| > This posting is provided "AS IS" with no warranties, and confers no
rights.
| >
| > --------------------
| > | Thread-Topic: Disappearing Emails
| > | thread-index: AccgOJXr0iRy0GY5RY2XwgLhm/MHiA==
| > | X-WBNR-Posting-Host: 82.141.234.141
| > | From: =?Utf-8?B?U2Ft?= <Sam@xxxxxxxxxxxxxxxxxxxxxxxxx>
| > | References: <6B327B1E-A025-46EC-A4F6-4CB56D1EEA12@xxxxxxxxxxxxx>
| > <PwDglfCIHHA.2024@xxxxxxxxxxxxxxxxxxxxxx>
| > | Subject: RE: Disappearing Emails
| > | Date: Fri, 15 Dec 2006 03:03:00 -0800
| > | Lines: 188
| > | Message-ID: <990EBB04-EE0C-4FD2-ADFC-F4E16FD1A5CA@xxxxxxxxxxxxx>
| > | MIME-Version: 1.0
| > | Content-Type: text/plain;
| > | charset="Utf-8"
| > | Content-Transfer-Encoding: 8bit
| > | X-Newsreader: Microsoft CDO for Windows 2000
| > | Content-Class: urn:content-classes:message
| > | Importance: normal
| > | Priority: normal
| > | X-MimeOLE: Produced By Microsoft MimeOLE V6.00.3790.2757
| > | Newsgroups: microsoft.public.windows.server.sbs
| > | Path: TK2MSFTNGHUB02.phx.gbl
| > | Xref: TK2MSFTNGHUB02.phx.gbl microsoft.public.windows.server.sbs:4489
| > | NNTP-Posting-Host: tk2msftsbfm01.phx.gbl 10.40.244.148
| > | X-Tomcat-NG: microsoft.public.windows.server.sbs
| > |
| > | Hi Terence,
| > |
| > | Thank you for you detailed post.
| > |
| > | The story so far.
| > |
| > | Generally email are coming in and out no problem then i start getting
| > | reports from my users that over the past couple of weeks customers
were
| > | sending emails to our domain but my users were not receiving the
mails.
| > The
| > | sender would "not" receive a NDR and they would think the mail got
| > through.
| > |
| > | It is an SMTP feed to the server
| > |
| > | 1. Not happening on all mails. The other day a user was waiting for a
| > mail
| > | at 2pm. The mail didn�t turn up so he contacted the sender who
resent
| > it at
| > | 6pm. The 6pm mail came through no sign of the 2pm one! I checked with
my
| > ISP
| > | who had routed the mail at 2pm.
| > |
| > | There are two domains coming into the exchange server one that was
the
| > old
| > | domain and then a company re-branding produced another domain name.
| > | Each domain is hosted by a different company.
| > | New domain is spam filtered externally but the old domain is hosted
by a
| > | company that no matter how much i asked spam still comes through so i
| > | activated the IMF for this reason. (I have checked to folder but only
| > spam
| > | not the missing mails)
| > |
| > | I have enabled SMTP logging as you suggested but as emails are flying
in
| > and
| > | out i will only know when a user notifies me of a missing mail that i
can
| > | look through the logs.
| > |
| > | I have a Sonic Wall TZ 170 with up to date firmware,
| > | E-Trust Anti Virus with mail option.
| > |
| > |
| > | Thanks again for your reply
| > | Sam
| > |
| > |
| > | "Terence Liu [MSFT]" wrote:
| > |
| > | > Hello Sam,
| > | >
| > | > Thank you for posting here.
| > | >
| > | > According to your description, I understand that your exchange 2003
| > server
| > | > can not receive some external emails and sender receive error
"message
| > | > undeliverable". If I have misunderstood the problem, please don't
| > hesitate
| > | > to let me know.
| > | >
| > | > First, please let me know which your exchange server uses to
receive,
| > SMTP
| > | > or POP3 Connector?
| > | >
| > | > And you mentioned that "People who have emailed us in the past will
| > send an
| > | > email but not get any response not even "message undeliverable"", I
| > want to
| > | > know whether the sender get a NDR, if yes, please send the NDR to
me at
| > | > v-terliu@xxxxxxxxxxxxx, if not, please capture a screenshot on the
| > error
| > | > message and send the picture to me.
| > | >
| > | > Before we go any further, please let me know the following
information
| > so
| > | > that we can understand your situation more clearly.
| > | >
| > | > 1. Is this issue happens on all external emails?
| > | >
| > | > 2. Please let me know your email address and I want to send a test
mail
| > to
| > | > your mailbox.
| > | >
| > | > 3. Can you telnet 25 port from Internet to your exchange server?
Try to
| > | > send a test mail in telnet command line, what the result is?
| > | >
| > | > XFOR: Telnet to Port 25 of IMC to Test IMC Communication:
| > | > http://support.microsoft.com/?id=153119
| > | >
| > | > 4. Enable SMTP logging and gather SMTP log to troubleshoot the
issue:
| > | >
| > | > A. Open Exchange System Manager, expand Servers -> <Server name> ->
| > | > Protocols -> SMTP, right-click "Default SMTP Virtual Server" and
click
| > | > Properties.
| > | >
| > | > B. Under the General tab, check the option "Enable Logging".
| > | >
| > | > C. With "W3C Extended Log File Format", click "Properties".
| > | >
| > | > D. Under "General Properties", make sure "Use local time for file
| > naming
| > | > and rollover" is CHECKED.
| > | >
| > | > E. Switch to the "Extended Properties", and then select to enable
All
| > the
| > | > logging Options.
| > | >
| > | > F. Click OK to apply the modification.
| > | >
| > | > G. Right-click Default SMTP Virtual Server and click Stop.
| > | >
| > | > H. Right-click Default SMTP Virtual Server and click Start to
restart
| > the
| > | > SMTP server.
| > | >
| > | > I. Reproduce the issue, send a test email from external, then
repeat
| > step G
| > | > to stop Default SMTP Virtual Server, copy out or zip the SMTP log
files
| > in
| > | > the "%systemroot%\system32\logfiles\SmtpSvc1" folder, and then
restart
| > the
| > | > "Default SMTP Virtual Server".
| > | >
| > | > J. Please send the zip file to me and let me know the test mail's
| > sender,
| > | > receiver and subject.
| > | >
| > | > 5. As you mentioned "I am running the IMF as another domains
emails(Not
| > | > filtered externally) are received by this server.", I do not
understand
| > | > clearly, what do you exactly mean?
| > | >
| > | > Hope these steps will give you some help.
| > | >
| > | > Thanks and have a nice day!
| > | >
| > | > Best regards,
| > | >
| > | > Terence Liu(MSFT)
| > | >
| > | > Microsoft CSS Online Newsgroup Support
| > | >
| > | > Get Secure! - www.microsoft.com/security
| > | >
| > | > =====================================================
| > | > This newsgroup only focuses on SBS technical issues. If you have
issues
| > | > regarding other Microsoft products, you'd better post in the
| > corresponding
| > | > newsgroups so that they can be resolved in an efficient and timely
| > manner.
| > | > You can locate the newsgroup here:
| > | > http://www.microsoft.com/communities/newsgroups/en-us/default.aspx
| > | >
| > | > When opening a new thread via the web interface, we recommend you
check
| > the
| > | > "Notify me of replies" box to receive e-mail notifications when
there
| > are
| > | > any updates in your thread. When responding to posts via your
| > newsreader,
| > | > please "Reply to Group" so that others may learn and benefit from
your
| > | > issue.
| > | >
| > | > Microsoft engineers can only focus on one issue per thread.
Although we
| > | > provide other information for your reference, we recommend you post
| > | > different incidents in different threads to keep the thread clean.
In
| > doing
| > | > so, it will ensure your issues are resolved in a timely manner.
| > | >
| > | > For urgent issues, you may want to contact Microsoft CSS directly.
| > Please
| > | > check http://support.microsoft.com for regional support phone
numbers.
| > | >
| > | > Any input or comments in this thread are highly appreciated.
| > | > =====================================================
| > | >
| > | > This posting is provided "AS IS" with no warranties, and confers no
| > rights.
| > | >
| > | > --------------------
| > | > | Thread-Topic: Disappearing Emails
| > | > | thread-index: AccfuyN7NJQUUYXDS6aIwRa8ckZkxw==
| > | > | X-WBNR-Posting-Host: 80.249.248.9
| > | > | From: =?Utf-8?B?U2Ft?= <Sam@xxxxxxxxxxxxxxxxxxxxxxxxx>
| > | > | Subject: Disappearing Emails
| > | > | Date: Thu, 14 Dec 2006 12:05:01 -0800
| > | > | Lines: 12
| > | > | Message-ID: <6B327B1E-A025-46EC-A4F6-4CB56D1EEA12@xxxxxxxxxxxxx>
|

.