RE: Exchange/IIS SMTP logs

  • From: "John Tolmachoff \(Lists\)" <johnlist@xxxxxxxxxxxxxxxxxxx>
  • To: "'[ExchangeList]'" <exchangelist@xxxxxxxxxxxxx>
  • Date: Fri, 11 Jun 2004 08:23:03 -0700

> John, what else is installed on this server?  Any anti-virus or other
> applications?

Unfortunately, this server was built by some one other than me, and rather
poorly at that. (OS partition is only 4 GB and Exchange partition is 5 GB). 

Server is/has:
1st DC
Symantec AV Corp 8.1 protecting the server, appropriate parts of C and D as
well as M excluded.
File server
Print server (2 printers)

> If every 4th message the message goes somewhere unexpected, I'd look there
> first. I'd also look at the messages the user says are being sent for a
> pattern to help troubleshoot. Turn up the logging to see what else it
> on (why is X.400 involved?  Is this a mixed environment?).

Not every 4th message, but 4 messages in one week out of say 200. I have
found no pattern in those 4 messages. Different recipients, different times,
different subject lines, different bodies, etc. I have turned up logging. I
do not know why X.400 is involved, as I did not set up this server. If
possible, I would like to eliminate it. All outgoing is sent to a smart

> Finally, once you have located the message (it's in the users outbox
> presumably), have them send again and sniff the wire to see what's going
> there an if the message actually ever does leave the machine.  If you have
> some questionable apps on the server, it's a good idea to find that out

But sniff the wire where? Message tracking shows the Information Store had
the message. The question is, what happen to it after that.

John Tolmachoff
eServices For You

Other related posts: