exchange problem

restart of the sbs 2003 r2 server sent out large batch of old mail (Some
months old) and deposited 15-20 messages in various users inboxes from system
administrator about undeliverable mail to reciepients that could not be
reached. They are getting calls/emails from the reciepients of this old mail
wondering what's up. Why did this happen and how can i find out what emails
went out. They are not in the users sent folder for the day of the restart.

Mike-in-Houston wrote:
> restart of the sbs 2003 r2 server sent out large batch of old mail (Some
> months old) and deposited 15-20 messages in various users inboxes from system
> administrator about undeliverable mail to reciepients that could not be
> reached. They are getting calls/emails from the reciepients of this old mail
> wondering what's up. Why did this happen and how can i find out what emails
> went out. They are not in the users sent folder for the day of the restart.

First stop is the Message Tracking Center in Tools in the Exchange
manager. Look into one of the emails there and possibly there will be
some explanation. Generally if mail sits in an SMTP queue for very long,
the administrator will be emailed about it, so that doesn't seem likely.
Presumably this isn't the first reboot since the emails were originally
sent. Do you know if they were received at that time?

It does get worse than this. I once cleaned up a virus on an NT4 server,
rebooted and... you're way ahead of me, aren't you? Yes, a batch of
viruses got re-sent as Exchange 'wasn't sure these emails have been
sent' or something similar, and I had to do another mass email grovel to
the recipients, having already assured them it wouldn't happen again.

--
Joe

Mike-in-Houston <> wrote:
> restart of the sbs 2003 r2 server sent out large batch of old mail
> (Some months old) and deposited 15-20 messages in various users
> inboxes from system administrator about undeliverable mail to
> reciepients that could not be reached. They are getting calls/emails
> from the reciepients of this old mail wondering what's up. Why did
> this happen and how can i find out what emails went out. They are
> not in the users sent folder for the day of the restart.

Embarrassing, isn't it? I've seen this happen a few times.

Make sure your antivirus software is excluding all Exchange folders
(queue/log/database) from any and all scanning, both scheduled & realtime.

If this problem recurs you can also use MFCMapi to kill the temp table and
recreate it ...
http://msexchangetips.blogspot.com/2...ange-temp.html

There is also this possibility:

http://support.microsoft.com/default.aspx/kb/950757

Then you have to create the key Queuing and the sub key "GlitchRetrySeconds"
as follows:

In HKLM\System\CurrentControlSet\Services\SMTPSVC\Que uing, create "GlitchRetrySeconds"
as a dword and try a value of 60 or 120. Then restart the SMTP service.
-
Larry
Please post the resolution to your
issue so others may benefit
-
Get Your SBS Health Check at
www.sbsbpa.com


> restart of the sbs 2003 r2 server sent out large batch of old mail
> (Some months old) and deposited 15-20 messages in various users
> inboxes from system administrator about undeliverable mail to
> reciepients that could not be reached. They are getting calls/emails
> from the reciepients of this old mail wondering what's up. Why did
> this happen and how can i find out what emails went out. They are not
> in the users sent folder for the day of the restart.
>

Thanks to all for your input.
I've download and installed the Hotfix, however, I don't have Queuing
subfolder in My registry under SMTPSVC . CAn I place that GlitchRetrySeconds
item in a different folder or should I create one somehow?


"Larry Struckmeyer[SBS-MVP]" wrote:

> There is also this possibility:
>
> http://support.microsoft.com/default.aspx/kb/950757
>
> Then you have to create the key Queuing and the sub key "GlitchRetrySeconds"
> as follows:
>
> In HKLM\System\CurrentControlSet\Services\SMTPSVC\Que uing, create "GlitchRetrySeconds"
> as a dword and try a value of 60 or 120. Then restart the SMTP service.
> -
> Larry
> Please post the resolution to your
> issue so others may benefit
> -
> Get Your SBS Health Check at
> www.sbsbpa.com
>
>
> > restart of the sbs 2003 r2 server sent out large batch of old mail
> > (Some months old) and deposited 15-20 messages in various users
> > inboxes from system administrator about undeliverable mail to
> > reciepients that could not be reached. They are getting calls/emails
> > from the reciepients of this old mail wondering what's up. Why did
> > this happen and how can i find out what emails went out. They are not
> > in the users sent folder for the day of the restart.
> >
>
>
> .
>

Sorry, It's late and I should have read your instructions slower. I added
that registry key and subkey successfully, Lets hope this is all behind me.

Thanks again.

"Larry Struckmeyer[SBS-MVP]" wrote:

> There is also this possibility:
>
> http://support.microsoft.com/default.aspx/kb/950757
>
> Then you have to create the key Queuing and the sub key "GlitchRetrySeconds"
> as follows:
>
> In HKLM\System\CurrentControlSet\Services\SMTPSVC\Que uing, create "GlitchRetrySeconds"
> as a dword and try a value of 60 or 120. Then restart the SMTP service.
> -
> Larry
> Please post the resolution to your
> issue so others may benefit
> -
> Get Your SBS Health Check at
> www.sbsbpa.com
>
>
> > restart of the sbs 2003 r2 server sent out large batch of old mail
> > (Some months old) and deposited 15-20 messages in various users
> > inboxes from system administrator about undeliverable mail to
> > reciepients that could not be reached. They are getting calls/emails
> > from the reciepients of this old mail wondering what's up. Why did
> > this happen and how can i find out what emails went out. They are not
> > in the users sent folder for the day of the restart.
> >
>
>
> .
>

Is there a simple way to generate a listing of all the emails that went out
during that restart? I tried following Joe's instructions using the Message
Tracking Center, but couldn't figure out how to make it work for all senders
from a start date/time to end date/time. I had thought all the messages that
went out had a corresponding system administraor message in the senders inbox
that I could assemble a list from to send out an explanation/apology, but not
so.

"Larry Struckmeyer[SBS-MVP]" wrote:

> There is also this possibility:
>
> http://support.microsoft.com/default.aspx/kb/950757
>
> Then you have to create the key Queuing and the sub key "GlitchRetrySeconds"
> as follows:
>
> In HKLM\System\CurrentControlSet\Services\SMTPSVC\Que uing, create "GlitchRetrySeconds"
> as a dword and try a value of 60 or 120. Then restart the SMTP service.
> -
> Larry
> Please post the resolution to your
> issue so others may benefit
> -
> Get Your SBS Health Check at
> www.sbsbpa.com
>
>
> > restart of the sbs 2003 r2 server sent out large batch of old mail
> > (Some months old) and deposited 15-20 messages in various users
> > inboxes from system administrator about undeliverable mail to
> > reciepients that could not be reached. They are getting calls/emails
> > from the reciepients of this old mail wondering what's up. Why did
> > this happen and how can i find out what emails went out. They are not
> > in the users sent folder for the day of the restart.
> >
>
>
> .
>

Mike-in-Houston wrote:
> Is there a simple way to generate a listing of all the emails that went out
> during that restart? I tried following Joe's instructions using the Message
> Tracking Center, but couldn't figure out how to make it work for all senders
> from a start date/time to end date/time. I had thought all the messages that
> went out had a corresponding system administraor message in the senders inbox
> that I could assemble a list from to send out an explanation/apology, but not
> so.
>

That should be the easiest thing to do. At startup, you need to put in
the server name, as outside the SBS world, this tool will contact other
Exchange servers it knows about. Hit go, and you will get a complete
listing to the current time from the last midnight. Enter dates and
times (earlier first, it won't allow time reversal) and you should see
it all.

Since these emails went out in a batch, you probably won't have many
genuine real-time ones among them. Now. if you select an email, you
should get a list of processing stages. This is where the MTC falls down
a bit, as there is not much detail. There might just be enough to take
us a bit further in this investigation. Of course, if the MTC can't see
them at all, it gets a bit more difficult...

--
Joe

As a test, I put in the server name jwserver.jwpc2.local and with the default
start and end date and time (Midnight today to 8am today), I click find now
and get the following error pop up.

An error occurred during a call to Windows Management Instrumentation.
Id no: 80041010
Excahange System Management


"Joe" wrote:

> Mike-in-Houston wrote:
> > Is there a simple way to generate a listing of all the emails that went out
> > during that restart? I tried following Joe's instructions using the Message
> > Tracking Center, but couldn't figure out how to make it work for all senders
> > from a start date/time to end date/time. I had thought all the messages that
> > went out had a corresponding system administraor message in the senders inbox
> > that I could assemble a list from to send out an explanation/apology, but not
> > so.
> >
>
> That should be the easiest thing to do. At startup, you need to put in
> the server name, as outside the SBS world, this tool will contact other
> Exchange servers it knows about. Hit go, and you will get a complete
> listing to the current time from the last midnight. Enter dates and
> times (earlier first, it won't allow time reversal) and you should see
> it all.
>
> Since these emails went out in a batch, you probably won't have many
> genuine real-time ones among them. Now. if you select an email, you
> should get a list of processing stages. This is where the MTC falls down
> a bit, as there is not much detail. There might just be enough to take
> us a bit further in this investigation. Of course, if the MTC can't see
> them at all, it gets a bit more difficult...
>
> --
> Joe
> .
>

Mike-in-Houston wrote:
> As a test, I put in the server name jwserver.jwpc2.local and with the default
> start and end date and time (Midnight today to 8am today), I click find now
> and get the following error pop up.
>
> An error occurred during a call to Windows Management Instrumentation.
> Id no: 80041010
> Excahange System Management
>
>

Not good. There seem to be various causes of this, and here's one
recommendation:

http://forums.msexchange.org/WMI_err...0498640/tm.htm

and you might spend some time with Google to see if you can find more
possibilities. Some recommendations are to reinstall Exchange...

As it's happening on a machine on which Exchange has already done
something non-standard which probably doesn't involve WMI, I wouldn't be
too confident about just re-registering dlls, but stranger things have
worked.

Hopefully someone else has seen this kind of problem...

--
Joe