The previous post made it look like the store handed it off to the MTA for delivery. Why is the question that begs to be answered. What versions of software are they? Check the Exchange and Windows Service pack versions to be sure you have some of the roll-up hotfixes etc. Al -----Original Message----- From: John Tolmachoff (Lists) [mailto:johnlist@xxxxxxxxxxxxxxxxxxx] Sent: Friday, June 11, 2004 11:23 AM To: [ExchangeList] Subject: [exchangelist] RE: Exchange/IIS SMTP logs http://www.MSExchange.org/ > John, what else is installed on this server? Any anti-virus or other > applications? Unfortunately, this server was built by some one other than me, and rather poorly at that. (OS partition is only 4 GB and Exchange partition is 5 GB). Server is/has: 1st DC Exchange Symantec AV Corp 8.1 protecting the server, appropriate parts of C and D as well as M excluded. File server Print server (2 printers) > If every 4th message the message goes somewhere unexpected, I'd look > there first. I'd also look at the messages the user says are being > sent for a pattern to help troubleshoot. Turn up the logging to see > what else it going > on (why is X.400 involved? Is this a mixed environment?). Not every 4th message, but 4 messages in one week out of say 200. I have found no pattern in those 4 messages. Different recipients, different times, different subject lines, different bodies, etc. I have turned up logging. I do not know why X.400 is involved, as I did not set up this server. If possible, I would like to eliminate it. All outgoing is sent to a smart host. > Finally, once you have located the message (it's in the users outbox > presumably), have them send again and sniff the wire to see what's > going on > there an if the message actually ever does leave the machine. If you > have some questionable apps on the server, it's a good idea to find > that out now. But sniff the wire where? Message tracking shows the Information Store had the message. The question is, what happen to it after that. John Tolmachoff Engineer/Consultant/Owner eServices For You ------------------------------------------------------ List Archives: http://www.webelists.com/cgi/lyris.pl?enter=exchangelist Exchange Newsletters: http://www.msexchange.org/pages/newsletter.asp Exchange FAQ: http://www.msexchange.org/pages/larticle.asp?type=FAQ ------------------------------------------------------ Other Internet Software Marketing Sites: World of Windows Networking: http://www.windowsnetworking.com Leading Network Software Directory: http://www.serverfiles.com No.1 ISA Server Resource Site: http://www.isaserver.org Windows Security Resource Site: http://www.windowsecurity.com/ Network Security Library: http://www.secinf.net/ Windows 2000/NT Fax Solutions: http://www.ntfaxfaq.com ------------------------------------------------------ You are currently subscribed to this MSEXchange.org Discussion List as: al.mulnick@xxxxxxxxxx To unsubscribe visit http://www.webelists.com/cgi/lyris.pl?enter=exchangelist