RE: Sanity check

2012-11-01 Thread Michael B. Smith 
I would look in the Connectivity logs to verify, but sounds like it.

From: Candee [mailto:can...@gmail.com]
Sent: Thursday, November 1, 2012 12:33 PM
To: MS-Exchange Admin Issues
Subject: Sanity check


Exchange 2010 - fully patched; Outlook 2010 on the user's end.

One user is getting the same NDR every eleven minutes. I don't see any 
corresponding events in any of the event logs (2 CAS servers, 2 MBX servers).

The tracking logs have Receive (SMTP) /Deliver, over and over - each messageID 
repeated just twice.
Am I right in thinking it's on the other side?

Thanks!
Candee

---
To manage subscriptions click here: 
http://lyris.sunbelt-software.com/read/my_forums/
or send an email to 
listmana...@lyris.sunbeltsoftware.com
with the body: unsubscribe exchangelist

---
To manage subscriptions click here: 
http://lyris.sunbelt-software.com/read/my_forums/
or send an email to listmana...@lyris.sunbeltsoftware.com
with the body: unsubscribe exchangelist

Re: Sanity check

2012-11-01 Thread Candee 
Thanks, I will.



On Thu, Nov 1, 2012 at 12:52 PM, Michael B. Smith wrote:

>  I would look in the Connectivity logs to verify, but sounds like it.
>
> ** **
>
> *From:* Candee [mailto:can...@gmail.com]
> *Sent:* Thursday, November 1, 2012 12:33 PM
> *To:* MS-Exchange Admin Issues
> *Subject:* Sanity check
>
> ** **
>
> Exchange 2010 - fully patched; Outlook 2010 on the user's end.
>
> One user is getting the same NDR every eleven minutes. I don't see any
> corresponding events in any of the event logs (2 CAS servers, 2 MBX
> servers).
>
> The tracking logs have Receive (SMTP) /Deliver, over and over - each
> messageID repeated just twice.
>
> Am I right in thinking it's on the other side?
>
>  
>
> Thanks!
>
> Candee
>
> ---
> To manage subscriptions click here:
> http://lyris.sunbelt-software.com/read/my_forums/
> or send an email to listmana...@lyris.sunbeltsoftware.com
> with the body: unsubscribe exchangelist
>
> ---
> To manage subscriptions click here:
> http://lyris.sunbelt-software.com/read/my_forums/
> or send an email to listmana...@lyris.sunbeltsoftware.com
> with the body: unsubscribe exchangelist
>

---
To manage subscriptions click here: 
http://lyris.sunbelt-software.com/read/my_forums/
or send an email to listmana...@lyris.sunbeltsoftware.com
with the body: unsubscribe exchangelist

RE: Sanity check

2012-11-01 Thread Campbell, Rob 
What do the headers look like?

Was the NDR issued by your server, or was it accepted and then rejected farther 
downstream?

From: Candee [mailto:can...@gmail.com]
Sent: Thursday, November 01, 2012 12:33 PM
To: MS-Exchange Admin Issues
Subject: Re: Sanity check

Okay, so I was wrong.
There's no trace of it in our spam appliance logs.
What's next? Move the mailbox?
I have been Googling (funny how that became a verb!) all morning, but I haven't 
found much useful information.



On Thu, Nov 1, 2012 at 12:59 PM, Candee 
mailto:can...@gmail.com>> wrote:
Thanks, I will.



On Thu, Nov 1, 2012 at 12:52 PM, Michael B. Smith 
mailto:mich...@smithcons.com>> wrote:
I would look in the Connectivity logs to verify, but sounds like it.

From: Candee [mailto:can...@gmail.com<mailto:can...@gmail.com>]
Sent: Thursday, November 1, 2012 12:33 PM
To: MS-Exchange Admin Issues
Subject: Sanity check


Exchange 2010 - fully patched; Outlook 2010 on the user's end.

One user is getting the same NDR every eleven minutes. I don't see any 
corresponding events in any of the event logs (2 CAS servers, 2 MBX servers).

The tracking logs have Receive (SMTP) /Deliver, over and over - each messageID 
repeated just twice.
Am I right in thinking it's on the other side?

Thanks!
Candee

---
To manage subscriptions click here: 
http://lyris.sunbelt-software.com/read/my_forums/
or send an email to 
listmana...@lyris.sunbeltsoftware.com<mailto:listmana...@lyris.sunbeltsoftware.com>
with the body: unsubscribe exchangelist

---
To manage subscriptions click here: 
http://lyris.sunbelt-software.com/read/my_forums/
or send an email to 
listmana...@lyris.sunbeltsoftware.com<mailto:listmana...@lyris.sunbeltsoftware.com>
with the body: unsubscribe exchangelist


---
To manage subscriptions click here: 
http://lyris.sunbelt-software.com/read/my_forums/
or send an email to 
listmana...@lyris.sunbeltsoftware.com<mailto:listmana...@lyris.sunbeltsoftware.com>
with the body: unsubscribe exchangelist


---
To manage subscriptions click here: 
http://lyris.sunbelt-software.com/read/my_forums/
or send an email to 
listmana...@lyris.sunbeltsoftware.com<mailto:listmana...@lyris.sunbeltsoftware.com>
with the body: unsubscribe exchangelist
**
Note: 
The information contained in this message may be privileged and confidential 
and 
protected from disclosure.  If the reader of this message is not the intended  
recipient, or an employee or agent responsible for delivering this message to  
the intended recipient, you are hereby notified that any dissemination,   
distribution or copying of this communication is strictly prohibited. If you  
have received this communication in error, please notify us immediately by  
replying to the message and deleting it from your computer. 
**

---
To manage subscriptions click here: 
http://lyris.sunbelt-software.com/read/my_forums/
or send an email to listmana...@lyris.sunbeltsoftware.com
with the body: unsubscribe exchangelist

RE: Sanity check

2012-11-01 Thread Alice Goodman 
See if a smart phone is involved. I have had that experience here.

Alice

From: Candee [mailto:can...@gmail.com]
Sent: Thursday, November 01, 2012 11:33 AM
To: MS-Exchange Admin Issues
Subject: Re: Sanity check

Apparently my server is sending it every eleven minutes, and the appliance is 
generating the NDR.
It seems the message is being marked as a temp-fail instead of a permanent fail.

"Nov  1 10:22:21 smtp sm-mta[18146]: qA1FCKQc018146: timeout waiting for input 
from mail.braueronline.com<http://mail.braueronline.com>. during client DATA 
status "
On Thu, Nov 1, 2012 at 2:04 PM, Candee 
mailto:can...@gmail.com>> wrote:
Good catch - the originating machine is our spam appliance.
I don't have access to the logs on that; I emailed the vendor to check for me.
Thanks!


On Thu, Nov 1, 2012 at 1:44 PM, John Matteson 
mailto:john.matte...@gmail.com>> wrote:
Hi Candee:

Try checking the send queue on your gateway system (whatever 
machine actually processes mail to destinations on the Internet). See if it's 
there. If you don't see it there, then check the connectivity logs there.

Also, what is the originating machine for the NDR going to the user?

John M.

From: Candee [mailto:can...@gmail.com<mailto:can...@gmail.com>]
Sent: Thursday, November 01, 2012 1:33 PM

To: MS-Exchange Admin Issues
Subject: Re: Sanity check

Okay, so I was wrong.
There's no trace of it in our spam appliance logs.
What's next? Move the mailbox?
I have been Googling (funny how that became a verb!) all morning, but I haven't 
found much useful information.



On Thu, Nov 1, 2012 at 12:59 PM, Candee 
mailto:can...@gmail.com>> wrote:
Thanks, I will.



On Thu, Nov 1, 2012 at 12:52 PM, Michael B. Smith 
mailto:mich...@smithcons.com>> wrote:
I would look in the Connectivity logs to verify, but sounds like it.

From: Candee [mailto:can...@gmail.com<mailto:can...@gmail.com>]
Sent: Thursday, November 1, 2012 12:33 PM
To: MS-Exchange Admin Issues
Subject: Sanity check


Exchange 2010 - fully patched; Outlook 2010 on the user's end.

One user is getting the same NDR every eleven minutes. I don't see any 
corresponding events in any of the event logs (2 CAS servers, 2 MBX servers).

The tracking logs have Receive (SMTP) /Deliver, over and over - each messageID 
repeated just twice.
Am I right in thinking it's on the other side?

Thanks!
Candee

---
To manage subscriptions click here: 
http://lyris.sunbelt-software.com/read/my_forums/
or send an email to 
listmana...@lyris.sunbeltsoftware.com<mailto:listmana...@lyris.sunbeltsoftware.com>
with the body: unsubscribe exchangelist

---
To manage subscriptions click here: 
http://lyris.sunbelt-software.com/read/my_forums/
or send an email to 
listmana...@lyris.sunbeltsoftware.com<mailto:listmana...@lyris.sunbeltsoftware.com>
with the body: unsubscribe exchangelist


---
To manage subscriptions click here: 
http://lyris.sunbelt-software.com/read/my_forums/
or send an email to 
listmana...@lyris.sunbeltsoftware.com<mailto:listmana...@lyris.sunbeltsoftware.com>
with the body: unsubscribe exchangelist


---
To manage subscriptions click here: 
http://lyris.sunbelt-software.com/read/my_forums/
or send an email to 
listmana...@lyris.sunbeltsoftware.com<mailto:listmana...@lyris.sunbeltsoftware.com>
with the body: unsubscribe exchangelist

---
To manage subscriptions click here: 
http://lyris.sunbelt-software.com/read/my_forums/
or send an email to 
listmana...@lyris.sunbeltsoftware.com<mailto:listmana...@lyris.sunbeltsoftware.com>
with the body: unsubscribe exchangelist



---
To manage subscriptions click here: 
http://lyris.sunbelt-software.com/read/my_forums/
or send an email to 
listmana...@lyris.sunbeltsoftware.com<mailto:listmana...@lyris.sunbeltsoftware.com>
with the body: unsubscribe exchangelist

---
To manage subscriptions click here: 
http://lyris.sunbelt-software.com/read/my_forums/
or send an email to listmana...@lyris.sunbeltsoftware.com
with the body: unsubscribe exchangelist

Re: Sanity check

2012-11-02 Thread Candee 
Thanks!
I had checked the list of *approved* phone users; but of course he was
connecting with his personal phone.
Bah.



On Thu, Nov 1, 2012 at 8:47 PM, Alice Goodman  wrote:

>  See if a smart phone is involved. I have had that experience here. 
>
> ** **
>
> Alice
>
> ** **
>
> *From:* Candee [mailto:can...@gmail.com]
> *Sent:* Thursday, November 01, 2012 11:33 AM
>
> *To:* MS-Exchange Admin Issues
> *Subject:* Re: Sanity check
>
> ** **
>
> Apparently my server is sending it every eleven minutes, and the appliance
> is generating the NDR.
>
> It seems the message is being marked as a temp-fail instead of a permanent
> fail.
>
>  
>
> "Nov  1 10:22:21 smtp sm-mta[18146]: qA1FCKQc018146: timeout waiting for
> input from mail.braueronline.com. during client DATA status "
>
> On Thu, Nov 1, 2012 at 2:04 PM, Candee  wrote:
>
> Good catch - the originating machine is our spam appliance.
>
> I don't have access to the logs on that; I emailed the vendor to check for
> me.
>
> Thanks!
>
>
>  
>
> On Thu, Nov 1, 2012 at 1:44 PM, John Matteson 
> wrote:
>
> Hi Candee:
>
>  
>
> Try checking the send queue on your gateway system (whatever
> machine actually processes mail to destinations on the Internet). See if
> it’s there. If you don’t see it there, then check the connectivity logs
> there.
>
>  
>
> Also, what is the originating machine for the NDR going to the
> user?
>
>  ****
>
> John M.
>
>  
>
> *From:* Candee [mailto:can...@gmail.com]
> *Sent:* Thursday, November 01, 2012 1:33 PM
>
>
> *To:* MS-Exchange Admin Issues
> *Subject:* Re: Sanity check
>
>  
>
> Okay, so I was wrong.
>
> There's no trace of it in our spam appliance logs.
>
> What's next? Move the mailbox?
> I have been Googling (funny how that became a verb!) all morning, but
> I haven't found much useful information.
>
>
>
>  
>
> On Thu, Nov 1, 2012 at 12:59 PM, Candee  wrote:
>
> Thanks, I will.
>
>
>
>  
>
> On Thu, Nov 1, 2012 at 12:52 PM, Michael B. Smith 
> wrote:
>
>  I would look in the Connectivity logs to verify, but sounds like it.
>
>  
>
> *From:* Candee [mailto:can...@gmail.com]
> *Sent:* Thursday, November 1, 2012 12:33 PM
> *To:* MS-Exchange Admin Issues
> *Subject:* Sanity check
>
>  
>
> Exchange 2010 - fully patched; Outlook 2010 on the user's end.
>
> One user is getting the same NDR every eleven minutes. I don't see any
> corresponding events in any of the event logs (2 CAS servers, 2 MBX
> servers).
>
> The tracking logs have Receive (SMTP) /Deliver, over and over - each
> messageID repeated just twice.
>
> Am I right in thinking it's on the other side?
>
>  
>
> Thanks!
>
> Candee
>
> ---
> To manage subscriptions click here:
> http://lyris.sunbelt-software.com/read/my_forums/
> or send an email to listmana...@lyris.sunbeltsoftware.com
> with the body: unsubscribe exchangelist
>
> ---
> To manage subscriptions click here:
> http://lyris.sunbelt-software.com/read/my_forums/
> or send an email to listmana...@lyris.sunbeltsoftware.com
> with the body: unsubscribe exchangelist
>
> 
>
> ---
> To manage subscriptions click here:
> http://lyris.sunbelt-software.com/read/my_forums/
> or send an email to listmana...@lyris.sunbeltsoftware.com
> with the body: unsubscribe exchangelist
>
>  
>
> ---
> To manage subscriptions click here:
> http://lyris.sunbelt-software.com/read/my_forums/
> or send an email to listmana...@lyris.sunbeltsoftware.com
> with the body: unsubscribe exchangelist
>
> ---
> To manage subscriptions click here:
> http://lyris.sunbelt-software.com/read/my_forums/
> or send an email to listmana...@lyris.sunbeltsoftware.com
> with the body: unsubscribe exchangelist
>
> ** **
>
> ** **
>
> ---
> To manage subscriptions click here:
> http://lyris.sunbelt-software.com/read/my_forums/
> or send an email to listmana...@lyris.sunbeltsoftware.com
> with the body: unsubscribe exchangelist
>
> ---
> To manage subscriptions click here:
> http://lyris.sunbelt-software.com/read/my_forums/
> or send an email to listmana...@lyris.sunbeltsoftware.com
> with the body: unsubscribe exchangelist
>

---
To manage subscriptions click here: 
http://lyris.sunbelt-software.com/read/my_forums/
or send an email to listmana...@lyris.sunbeltsoftware.com
with the body: unsubscribe exchangelist