SMTP Server remote queue length alert

I posted the attached several weeks ago, but never had a chance to actually
look at the server until now. Basically, there are a lot of messages piling
up in SMTP queues. There are a dozen or so queues with names like
"SmallBusiness SMTP Connector - cia.gov" and "SmallBusiness SMTP Connector -
hidaho.com".

However, we don't use SMTP. The server hosts it's own email on the host's
Exchange server. I assume these SMTP emails are being generated by some
malicious code, although our virus checks and other checks have not revealed
anything on either the server or the clients. I am unable to delete the mail
in these queues (the delete option is greyed out), and I can't seem to find
out any more info on the emails (there is no sender, no subject, etc.)

 

I accidentally posted the base message before I finished it ....

So, to finish... I don't know where these SMTP emails are coming from, so I
need some help on:

1) How to track down their source
2) How to stop them from occuring
3) How to delete the messages and queues that are already out there

Again, we don't use SMTP email on an ISP.. we host our own email and that
mail is sent and received with no problems. But every day I see more of
these SMTP messages queued up.

Thanks

Here's the alert we keep getting:

Alert on SERVER at 11/29/2005 4:35:13 AM

A large number of messages are pending in the e-mail server send queue.

Verify that you have Internet connectivity. If you can view Web sites
normally, contact your Internet service provider (ISP) to determine if
there is a problem with their e-mail server.

You can disable this alert or change its threshold by using the Change
Alert Notifications task in the Server Management Monitoring and
Reporting taskpad.

 

Hello Adl,

Thank you for posting in the SBS newsgroup. I'm glad to working with you
again.

First of all, my sincerest apologies for the delay in responding due to
weekend, thanks for the understanding.

Please kindly note the partner managed newsgroups are staffed weekdays by
Microsoft Support professionals. Our goal is to provide a one business day
response to all posts.

For time critical issues (not business down), we encourage you to contact
CSS directly for more immediate assistance:
International Support (non-US/Canada):
http://support.microsoft.com/common/international.aspx

US and Canada:
http://support.microsoft.com/default.aspx?scid=fh;EN-US;OfferProPhone

To continue working with me in the newsgroups, please see the following:

According to your description, I understand that you received this Alert
message "A large number of messages are pending in the e-mail server send
queue". If I have misunderstood the problem, please don't hesitate to let
me know.

To narrow down this issue, please kindly answer and perform the following
questions and steps:

1. First of all, please kindly note that in SBS 2003, the CEICW
automatically creates a SMTP connector for outgoing messages. The
bridgehead defines the Exchange server which can use this SMTP connector to
deliver the outgoing e-mails. SMTP connector is based on SMTP virtual
server and SMTP service. It provides more functions than the SMTP VS does.

More information:
294736 When to create SMTP connectors in Exchange 2000 and later
http://support.microsoft.com/?id=294736

2. What method is used to receive incoming email (POP3 Connector or SMTP
service)? What method is used to send outgoing email (DNS route or ISP
Smarthost)?

3. Please refer to the following information to re-run the CEICW:

a. Run the CEICW and go through the Internet and firewall option.

b. In the Internet E-mail tab, please click to "Enable Internet E-mail".

c. In the Email Delivery method page, please choose the correct email
delivery method. If you need to forward internet email to your ISP
Smarthost, please input the Smarthost address correctly. If you use DNS to
route emails, please choose this option.

Note: If you choose to forward emails to the ISP's email server (smart
host), you need to type the FQDN of the ISP's email server. If your ISP
provides you the IP address of their email server, for example,
12.34.56.78, you should type the IP address as "[12.34.56.78]" (without the
quotation marks) on the connector's properties page.

d. In the E-mail Retrieval Method page, specify to receive e-mail using
one or both of the following methods:

- POP3 Mailboxes
- Exchange

Click Next.

e. In the E-mail Domain Name page, enter your registered e-mail Internet
domain name, (i.e. domain.com). The e-mail domain name should
match the mail exchanger (MX) resource record maintained at your ISP. This
must be a registered Internet domain name.

f. If you are using the POP3 Connector to retrieve incoming email, in the
POP3 Mailbox Accounts page, click Add and add the appropriate POP3
mailbox accounts, then click Next.

g. Input the correct information in the rest page and finish the wizard.

For delivering the internet emails, if you have hardware router, you should
make sure the Outbound TCP port 25 is opening. For your ISP configuration,
you ISP should allow TCP port 25 outbound communication.

If your SBS server uses ISP smarthost, I would like to bring the following
article to your attention

827601 Cannot send external mail when your smart host server is different
from
http://support.microsoft.com/?id=827601

825763 How to configure Internet access in Windows Small Business Server
2003
http://support.microsoft.com/?id=825763

4. If you're using POP3 connector, it will also cause open relaying.
Please check whether KB 835734 solves the problem.

Many unexpected outbound e-mail messages appear in the SMTP queue in Small
Business Server 2003
http://support.microsoft.com/kb/835734

More information for your reference:
You can follow this KB to block open SMTP relaying.
How to block open SMTP relaying and clean up Exchange Server SMTP queues in
Windows Small Business Server
http://support.microsoft.com/kb/324958

5. >> 1) How to track down their source
2) How to stop them from occuring
3) How to delete the messages and queues that are already out there

To check it, open the Exchange System Manager, go to Servers -> ServerName
-> Queues, double-click "SmallBusiness SMTP Connector - cia.gov" or
"SmallBusiness SMTP Connector - hidaho.com". In the dialog box, click "Find
Now" button, double-click these emails, you can find these messages'
detailed properties, such as: Sender, Subject, Recipients, etc. Right-click
it, choose "Delete (with NDR)" or "Delete (no NDR)" option to delete these
messages.

As you mentioned "I am unable to delete the mail in these queues (the
delete option is greyed out), and I can't seem to find out any more info on
the emails (there is no sender, no subject, etc.)", please kindly make a
screen shot of it, and then attach it in your reply.

6. If the issue persists, please enable SMTP logging and gather SMTP log
to troubleshoot the issue:

A. Open Exchange System Manager, expand Servers -> <Server name> ->
Protocols -> SMTP, right-click "Default SMTP Virtual Server" and click
Properties.

B. Under the General tab, check the option "Enable Logging".

C. With "W3C Extended Log File Format", click "Properties".

D. Under "General Properties", make sure "Use local time for file naming
and rollover" is CHECKED.

E. Switch to the "Extended Properties", and then select to enable All the
logging Options.

F. Click OK to apply the modification.

G. Right-click Default SMTP Virtual Server and click Stop.

H. Right-click Default SMTP Virtual Server and click Start to restart the
SMTP server.

I. Reproduce the issue, repeat step G to stop Default SMTP Virtual Server,
copy out or zip the SMTP log files in the
"%systemroot%\system32\logfiles\SmtpSvc1" folder, and then restart the
"Default SMTP Virtual Server".

I appreciate your time and cooperation. If anything is unclear, please feel
free to let me know. I am looking forward to hearing from you.

Best regards,

Nathan Liu (MSFT)
Microsoft CSS Online Newsgroup Support

Get Secure! - www.microsoft.com/security
======================================================
This newsgroup only focuses on SBS technical issues. If you have issues
regarding other Microsoft products, you'd better post in the corresponding
newsgroups so that they can be resolved in an efficient and timely manner.
You can locate the newsgroup here:
http://www.microsoft.com/communities/newsgroups/en-us/default.aspx

When opening a new thread via the web interface, we recommend you check the
"Notify me of replies" box to receive e-mail notifications when there are
any updates in your thread. When responding to posts via your newsreader,
please "Reply to Group" so that others may learn and benefit from your
issue.

Microsoft engineers can only focus on one issue per thread. Although we
provide other information for your reference, we recommend you post
different incidents in different threads to keep the thread clean. In doing
so, it will ensure your issues are resolved in a timely manner.

For urgent issues, you may want to contact Microsoft CSS directly. Please
check http://support.microsoft.com for regional support phone numbers.

Any input or comments in this thread are highly appreciated.
======================================================
This posting is provided "AS IS" with no warranties, and confers no rights.




--------------------