Source: smtpsvc; Event ID: 4000
|
Logged in as: Guest
|
|
Users viewing this topic:
none
|
|
Login  | |
|
Source: smtpsvc; Event ID: 4000 - 14.Apr.2004 4:50:00 AM
|
|
|
Zoran
Posts: 43
Joined: 13.Apr.2004
Status: offline
|
Hi all,
I have a lot of records (Warning; Source: smtpsvc; Event ID: 4000) in the app log on MSEC gateway. One of them says:
Message delivery to the remote domain '7084.satonawallmarketing.com' failed for the following reason: The connection was dropped by the remote host.
Anyone knows what is going on here?
Thanks in advance.
Zoran
|
|
|
|
|
RE: Source: smtpsvc; Event ID: 4000 - 14.Apr.2004 4:53:00 AM
|
|
|
Zoran
Posts: 43
Joined: 13.Apr.2004
Status: offline
|
Sorry, they are in the system log.
|
|
|
|
|
RE: Source: smtpsvc; Event ID: 4000 - 14.Apr.2004 5:29:00 AM
|
|
|
Patrizia
Posts: 8474
Joined: 18.Aug.2003
From: Malta
Status: offline
|
Hi Zoran,
This would happen if the machine to which the mails are being delivered to by the IIS SMTP server on the MailSecurity machine is rejecting the messages or the connection is being dropped.
How often is the issue occuring? Are there messages which are not being delivered?
Is this occuring with incoming or with outgoing mails?
|
|
|
|
|
RE: Source: smtpsvc; Event ID: 4000 - 14.Apr.2004 5:47:00 AM
|
|
|
Zoran
Posts: 43
Joined: 13.Apr.2004
Status: offline
|
Hi Patrizia and thanks for prompt respond,
it happens every few minutes, only with outgoing mail and all recipients' domains are something like spam or ads domains. Nobody of my users complained yet, and I tested open relay on my MSEC gateway and it is closed. Could it be that I have some kind of Trojan on my exchange or MSEC gateway or is somebody trying to relay mails over my gateway, as exchange is also closed for relay.
These are examples of the warnings:
Message delivery to the remote domain 'yes.com' failed for the following reason: The connection was dropped by the remote host.
Message delivery to the remote domain '6252.gropingnotallowedmail.com' failed for the following reason: The connection was dropped by the remote host.
Message delivery to the remote domain '9eeqi0a0y27pa0bh.youremailserver.com' failed for the following reason: An SMTP protocol error occurred.
Message delivery to the remote domain '2444.protonmail.net' failed for the following reason: The connection was dropped by the remote host.
Thank you,
Zoran
|
|
|
|
|
RE: Source: smtpsvc; Event ID: 4000 - 14.Apr.2004 6:57:00 AM
|
|
|
ruth11
Posts: 14
Joined: 13.Apr.2004
Status: offline
|
Hi Zoran,
I have this problem too but am not bothered about external domains like you list because I figure they just don't exist.
However, I now have it happening with some mails coming IN and it's my local domain that is disconnecting. At the same time, my exchange server says that it timed out waiting for the message body... We have just upgraded to the latest version of Mail Security... Incoming mail is very slow to be processed too compared with outgoing...
Does anyone have any ideas?
Cheers
Ruth
|
|
|
|
|
RE: Source: smtpsvc; Event ID: 4000 - 21.Apr.2004 6:29:00 PM
|
|
|
RiSER
Posts: 4
Joined: 9.Apr.2004
Status: offline
|
I have also these msg's in the event log, often weird domains, MSEC GW 8.1
|
|
|
|
|
RE: Source: smtpsvc; Event ID: 4000 - 22.Apr.2004 4:12:00 AM
|
|
|
Patrizia
Posts: 8474
Joined: 18.Aug.2003
From: Malta
Status: offline
|
Ruth,
Can you explain further what you mean when you say that 'Incoming mail is very slow to be processed too compared with outgoing' ?
Are you doing the same checks on outgoing mails as on incoming mails?
|
|
|
|
|
RE: Source: smtpsvc; Event ID: 4000 - 22.Apr.2004 4:14:00 PM
|
|
|
deltamflynn
Posts: 2
Joined: 21.Apr.2004
From: Raleigh
Status: offline
|
Patrizia
I am also have the same exacpt error message event ID 4000. It happens on outbound messages and almost always related to a spam message. I am loosing a few valid messages when the mail que gets backed up with the spam messages.
Did you happen to find a resolution to this problem.
Regards
Mark
|
|
|
|
|
RE: Source: smtpsvc; Event ID: 4000 - 23.Apr.2004 5:46:00 AM
|
|
|
Patrizia
Posts: 8474
Joined: 18.Aug.2003
From: Malta
Status: offline
|
Hi,
Note that this error occurs when the IIS is not able to send out a mail to a remote domain.
MailSecurity has no control over this.
However if you are sending Delivery reports, these may cause the issue, especially since most SPAM mails do not have a valid address.
[ April 23, 2004, 11:48 AM: Message edited by: Patrizia ]
|
|
|
|
|
RE: Source: smtpsvc; Event ID: 4000 - 23.Apr.2004 5:56:00 AM
|
|
|
Zoran
Posts: 43
Joined: 13.Apr.2004
Status: offline
|
Hi Patrizia,
Thank you for explanation.
Regards
Zoran
|
|
|
|
|
RE: Source: smtpsvc; Event ID: 4000 - 23.Apr.2004 10:23:00 AM
|
|
|
deltamflynn
Posts: 2
Joined: 21.Apr.2004
From: Raleigh
Status: offline
|
Patrizia
Yes I understand that this message occurs when smtpsvc is unable to reply to invalid spamm addresses. This is understandable.
The problem is however, when spamm mail arrives in the smtp que I am also getting the ID 4000 error when the smtp service is connectiing to my local exchange server. i.e. server on the same domain The message I get is " Message delivery to remote domain failed for the following reason. The connection was dropped by the remote host.
The funny thing is that 99 % of the good mail is deliverd. Only 1% of good mail seems to be dropped and never gets delivered.
Once I delete the spamm mail from the que the ID 4000 messages stop until more spamm arrives.
In addition the mail delivery becomes slow once the que fills with lots of spamm cuasing good mail to be delayed for sometimes hours and in some cases not delivered at all.
There must be some way for the smtp service to better handle the spamm mail ?
Regards
Mark
|
|
|
|
|
RE: Source: smtpsvc; Event ID: 4000 - 28.Apr.2004 8:45:00 AM
|
|
|
Patrizia
Posts: 8474
Joined: 18.Aug.2003
From: Malta
Status: offline
|
Hi,
Approximately how many emails are you receiving/sending per hour?
MailSecurity cannot help in this case, although you may configure some simple content checking rules to delete obvious SPAM emails. I
Note however that you may use MailEssentials as a solution to help in checking spam emails.
|
|
|
|
|
RE: Source: smtpsvc; Event ID: 4000 - 11.May2004 4:22:00 PM
|
|
|
darwin
Posts: 1
Joined: 10.May2004
From: Tulsa, Ok
Status: offline
|
I have the exact problem with a twist. I get a large number of these event ID 4000 smtpsvc error messages saying the same thing but i've also noticed that the relay server looses connectivity to the gfi machine on a very regular basis. Does anyone else have this problem ? Here is a good way to check... creat a simple batch file like this:
@echo off
:start
ping xxx.xxx.xxx
goto start
run this batch file and watch it. What happens to me is i get a replies from the ping but all of a sudden i start getting timeouts. A few minutes later 4-10 minutes, i start receiving replies again.
I am running GFI mail essentials on a seperate machine with nothing else on it. Windows 2k is loaded and all patches/updates applied. The Mail server is a windows 2000 server with a 3rd party mail server.
|
|
|
|
|
RE: Source: smtpsvc; Event ID: 4000 - 12.May2004 4:54:00 PM
|
|
|
bihler
Posts: 193
Joined: 25.Apr.2004
From: New Jersey, USA
Status: offline
|
Or you could open up a Command prompt and type
ping x.x.x.x -t
which will continue to ping until you stop it.
Martin
|
|
|
|
|
RE: Source: smtpsvc; Event ID: 4000 - 17.May2004 12:15:00 PM
|
|
|
Nicks
Posts: 2741
Joined: 17.Mar.2003
Status: offline
|
Darwin,
Such timeouts would clearly indicate that it is not a problem with any of the GFI products. They would indicate a network problem, since either Exchange, nor IIS as involved when pinging the machine.
Also, if you are running MailEssentials, check if you have configured it to generated NDRs to spam emails. This will also cause a huge email queue, since most of the NDR messages generated by MailEssntials will actually be destined to non-existent domains.
|
|
|
|
 New Messages |
 No New Messages |
 Hot Topic w/ New Messages |
 Hot Topic w/o New Messages |
 Locked w/ New Messages |
 Locked w/o New Messages |
|
 Post New Thread
Reply to Message
Post New Poll
Submit Vote
Delete My Own Post
Delete My Own Thread
Rate Posts |
|
|
Printable Version
