John, what else is installed on this server? Any anti-virus or other applications? If every 4th message the message goes somewhere unexpected, I'd look there first. I'd also look at the messages the user says are being sent for a pattern to help troubleshoot. Turn up the logging to see what else it going on (why is X.400 involved? Is this a mixed environment?). Finally, once you have located the message (it's in the users outbox presumably), have them send again and sniff the wire to see what's going on there an if the message actually ever does leave the machine. If you have some questionable apps on the server, it's a good idea to find that out now. -----Original Message----- From: John Tolmachoff (Lists) [mailto:johnlist@xxxxxxxxxxxxxxxxxxx] Sent: Thursday, June 10, 2004 7:24 PM To: [ExchangeList] Subject: [exchangelist] RE: Exchange/IIS SMTP logs Importance: High http://www.MSExchange.org/ Finally figured it out. Should be in the SMTP log at 23:34. Now I have a problem. Message tracker shows delivered: SMTP Store Driver: Message submitted from Store SMTP: Message submitted to Advanced Queuing SMTP: Started Message Submission to Advanced Queue SMTP: Message Submitted to Categorizer SMTP: Message Delivered Locally to remoteuser@xxxxxxxxxxxxxxxx SMTP Store Drive Submitted Message to MTA Message transferred to exchange.localdomain.com through X400 Problem is, message never shows up at the smart host, my mail server, which is the gateway. 3 other earlier messages to the remote user from the same local user were delivered fine, as seen in the SMTP server logs and on my SMTP server logs on my e-mail server. But I can not find this message anywhere, or referenced in any log. The local sender is of course not at all happy, as this happened 3 times last week, all to different recipients and on different days. I have not heard of any other instances. Help! John Tolmachoff Engineer/Consultant/Owner eServices For You > -----Original Message----- > From: John Tolmachoff (Lists) [mailto:johnlist@xxxxxxxxxxxxxxxxxxx] > Sent: Thursday, June 10, 2004 4:08 PM > To: [ExchangeList] > Subject: [exchangelist] Exchange/IIS SMTP logs > Importance: High > > http://www.MSExchange.org/ > > How I hate the format of these logs. > > If I am trying to find a message delivered outbound at 7:34 PM Eastern > Daylight Time (Mississauga) on 06/02/04, (message tracking shows > delivered to the SMTP server via X400 at that time) what time am I > looking for in the > log, and which log, the 06/02/04 log or the 06/01/04 log or the > 06/03/04 log? > > John Tolmachoff > Engineer/Consultant/Owner > eServices For You > > > > > ------------------------------------------------------ > List Archives: > http://www.webelists.com/cgi/lyris.pl?enter=exchangelist > Exchange Newsletters: http://www.msexchange.org/pages/newsletter.asp > Exchange FAQ: http://www.msexchange.org/pages/larticle.asp?type=FAQ > ------------------------------------------------------ > Other Internet Software Marketing Sites: > World of Windows Networking: http://www.windowsnetworking.com Leading > Network Software Directory: http://www.serverfiles.com > No.1 ISA Server Resource Site: http://www.isaserver.org Windows > Security Resource Site: http://www.windowsecurity.com/ Network > Security Library: http://www.secinf.net/ Windows 2000/NT Fax > Solutions: http://www.ntfaxfaq.com > ------------------------------------------------------ > You are currently subscribed to this MSEXchange.org Discussion List as: > johnlist@xxxxxxxxxxxxxxxxxxx > To unsubscribe visit http://www.webelists.com/cgi/lyris.pl?enter=exchangelist ------------------------------------------------------ List Archives: http://www.webelists.com/cgi/lyris.pl?enter=exchangelist Exchange Newsletters: http://www.msexchange.org/pages/newsletter.asp Exchange FAQ: http://www.msexchange.org/pages/larticle.asp?type=FAQ ------------------------------------------------------ Other Internet Software Marketing Sites: World of Windows Networking: http://www.windowsnetworking.com Leading Network Software Directory: http://www.serverfiles.com No.1 ISA Server Resource Site: http://www.isaserver.org Windows Security Resource Site: http://www.windowsecurity.com/ Network Security Library: http://www.secinf.net/ Windows 2000/NT Fax Solutions: http://www.ntfaxfaq.com ------------------------------------------------------ You are currently subscribed to this MSEXchange.org Discussion List as: al.mulnick@xxxxxxxxxx To unsubscribe visit http://www.webelists.com/cgi/lyris.pl?enter=exchangelist