Exchange 2003 - the mystery of the hidden email!

[gazankers]

Yesterday and today we are experiencing problems with email (LEA's fault we think, sending is ok but not receiving) but never the less I rebooted our exchange 2003 box just to be on the safe side. This had the interesting side effect of releasing a few emails sent over the last month or so.

 

These 'hidden' emails did not show up in the system manager queue so where were they stored, and how can I check if there is any in there in the future?

 

Any help would be greatly appreciated.

 

Gazza

[Lord_Edam]

Probably your anti virus or filtering software on your server. the emails get eaten by the categoriser, where your filter would normally do its stuff, but since the filter is/was not working properly they just hang there until you restart the services, which kicks them back to the start of the process if you're lucky, or just deletes them entirely if you're unlucky.

 

Particularly a problem with sophos puremessage if you're using it for anything more than absolutely basic virus filtering. and Surfcontrol's email content filtering (which seems to be missing 90% of the stored procedures it needs to work properly!)

 

Not sure if there is an easy way to check for them. I've never found one - the first we know there's a problem is someone complaining they didn't receive a specific email, and when we do message tracking it shows as getting as far as the categoriser and vanishing.

[gazankers]

Thanks for the reply, it sounds like you have hit the nail on the head because we installed Sophos Puremessage about 6 weeks ago.

 

I'm now thinking about getting in touch with Sophos and asking the question to see if they have a resolution.

 

Has anyone else seen this problem?

 

Thanks again.

[steve]

We just had this same problem with Sophos puremessage.

 

Did you manage to get anything from sophos?

[gazankers]

I spoke to Sophos and they said there should be no reason why this is happening, and checking the SMTP.log file within PureMessage might shed some light on it.

 

A bit pants really, I'll reboot the server tonight and see if the same thing happens again.