Dominic Fitzpatrick's questions

I have an application that sends smtp email via a local Exchange server at a customer. All the email sends ok (it gets to the recipient) but some email gets sent multiple times because my application never receives the 221 respose code to say that it has worked ok and so re-tries. We could remve the retries but often this is needed for genuine problems.

It happens more commonly on certain desination email addresses and will repeatedly happen on that email once it has.

I have captured the TCP stream of one that does work and one that doesn't. Obviously names changed to protect the guilty.

Did work:
220 SBS4S1.example.local Microsoft ESMTP MAIL Service ready at Thu, 16 Apr 2015 11:51:16 +0100
EHLO example-PC
250-SBS4S1.example.local Hello [192.168.111.15]
250-SIZE 10485760
250-PIPELINING
250-DSN
250-ENHANCEDSTATUSCODES
250-STARTTLS
250-AUTH
250-8BITMIME
250-BINARYMIME
250-CHUNKING
250-XEXCH50
250 XSHADOW
RSET
250 2.0.0 Resetting
MAIL FROM:<[email protected]>
250 2.1.0 Sender OK
RCPT TO:<[email protected]>
250 2.1.5 Recipient OK
DATA
354 Start mail input; end with <CRLF>.<CRLF>
--DATA Here, identical other than MIME/Content IDs in both emails--
.
250 2.6.0 <[email protected]> [InternalId=26602] Queued mail for delivery
QUIT
221 2.0.0 Service closing transmission channel

.

    Did NOT work:
    220 SBS4S1.example.local Microsoft ESMTP MAIL Service ready at Thu, 16 Apr 2015 11:43:39 +0100
    EHLO example-PC
    250-SBS4S1.example.local Hello [192.168.111.15]
    250-SIZE 10485760
    250-PIPELINING
    250-DSN
    250-ENHANCEDSTATUSCODES
    250-STARTTLS
    250-AUTH
    250-8BITMIME
    250-BINARYMIME
    250-CHUNKING
    250-XEXCH50
    250 XSHADOW
    RSET
    250 2.0.0 Resetting
    MAIL FROM:<[email protected]>
    250 2.1.0 Sender OK
    RCPT TO:<[email protected]>
    250 2.1.5 Recipient OK
    DATA
    354 Start mail input; end with <CRLF>.<CRLF>
    --DATA Here, identical other than MIME/Content IDs in both emails--
    .
    QUIT
    250 2.6.0 <[email protected]> [InternalId=26573] Queued mail for delivery


--This then times out but never gets the 221--

The only difference I can see other than the missing 221 is that the 250 and the QUIT are the other way around in the message that "fails". Is this a known Exchange quirk we have to work around, something we could fix or should cope with in our application or something we could ask to be changed on the mail server? We don't want to break anything for the normal, common situation.

Update: I thought we wouldn't be able to get hold of the Exchange logs (the admins didn't even know where they were) but I have! So the relevent line is:

Tarpit for '0.00:00:32.619' due to 'DelayedAck',Expired;Timeout

It looks like it might be due to:

https://mikecrowley.wordpress.com/2010/07/24/delayed-smtp-acknowledgement/

Got to try and get it tested first.

I have created a Task Scheduler event that emails me on EventID 14 in the Microsoft-Windows-Backup event log (note this is a new , style (Vista and up) log. I exported this and after some grubbing around on Serverfault and Technet, including this question

I got to the point of the XML for my task triggers being:

<Triggers>
    <EventTrigger>
      <Enabled>true</Enabled>
      <Subscription>&lt;QueryList&gt;&lt;Query Id="0" Path="Microsoft-Windows-Backup"&gt;&lt;Select Path="Microsoft-Windows-Backup"&gt;*[System[Provider[@Name='Microsoft-Windows-Backup'] and EventID=14]]&lt;/Select&gt;&lt;/Query&gt;&lt;/QueryList&gt;</Subscription>
      <ValueQueries>
        <Value name="eventChannel">Event/System/Channel</Value>
        <Value name="eventExinfo">Event/EventData/Data[@Name='ComponentStatus']</Value>
        <Value name="eventRecordID">Event/System/EventRecordID</Value>
        <Value name="eventSeverity">Event/System/Level</Value>
      </ValueQueries>
    </EventTrigger>
  </Triggers>

Unfortunately, this produces an error (a Launch Failiure on the Action). The very similar:

<Triggers>
    <EventTrigger>
      <Enabled>true</Enabled>
      <Subscription>&lt;QueryList&gt;&lt;Query Id="0" Path="Microsoft-Windows-Backup"&gt;&lt;Select Path="Microsoft-Windows-Backup"&gt;*[System[Provider[@Name='Microsoft-Windows-Backup'] and EventID=14]]&lt;/Select&gt;&lt;/Query&gt;&lt;/QueryList&gt;</Subscription>
      <ValueQueries>
        <Value name="eventChannel">Event/System/Channel</Value>
        <Value name="eventExinfo">Event/EventData/Data[@Name='BackupTemplateID']</Value>
        <Value name="eventRecordID">Event/System/EventRecordID</Value>
        <Value name="eventSeverity">Event/System/Level</Value>
      </ValueQueries>
    </EventTrigger>
  </Triggers>

Works fine and emails me the "BackupTemplateID" value.

I assume this is because the contents of "ComponentStatus" is itself XML but is not part of the Task Scheduler schema.

Does anyone know any way around this? Another method of getting the data is fine if this is not possible.

I would like this because the ComponentStatus section records if backup had a problem backing up Exchange as an Application, when the Event Description only indicates that the backup completed sucessfully.

The error is:

eseutil (2860) JetDBUtilities - 3928: The log file \?\GLOBALROOT\Device\HarddiskVolumeShadowCopy84\Program Files\Microsoft\Exchange Server\V14\Mailbox\Mailbox Database 0501047257\E000000B4E0.log is damaged, invalid, or inaccessible (error -501) and cannot be used. If this log file is required for recovery, a good copy of the log file will be needed for recovery to complete successfully.

Exchange appears to be running fine at the moment.

I have looked this error up and it looks like the log file specified may be permanently corrupt (I think this is what an error-501 means). Unfortunately a good version of that log file is too old to be on our backups.

There are various suggestions on the internet to run eseutil /mh to check the database and see what state it is in and see if that log file is actually required. Since this all require un-mounting the database, I am looking for the best first step to avoid any problems, for example, if the database won't remount. Is there a way, for example to back up everyone's email before unmounting the database, without going down the pst route?

We are going through a company merger and people want to do things differently!

Current situation:

• 2 DCs.
• 1 Exchange Server on 1 of the DCs (not SBS).The other half of the email is handled on a hosted Exchange server.
• Half the PCs are joined to one domain and half are not joined to any domain (the ones using hosted Exchange).

Currently desired situation:

• 0 DCs (I know this isn't possible when using Exchange).
• Everyone's PC not joined to a domain
• 1 Exchange server on the network that everyone can set up their Outlook to log into with both former domains MX records pointing at it.

I have a clean box to install 2008R2 and Exchange 2010 on. My current thought is to set up the Exchange as it's own domain and just set up the users on it and have them log in. Almost like setting up my own hosted exchange but on-site! This means the DCs can be ignored or demoted as desired and Exchange can sit there doing it's thing without being concerned what happens elsewhere. Is this the best option or are there gotchas that will kill it dead or better ways of doing things? We are a small company (less than 15 users) so convenience and flexibility rather than super-slick administration is more important.