SMTP notification closed unexpectedly

Hello



We are using 5.8.3 and using an external SMTP server.



In the logs of the external SMTP server, we are seeing the following when ServersCheck is trying to send an e-mail:



1496 10:55:20.445 About to start thread for client 10.0.2.24 socket 2324

1996 10:55:20.445 message <220 mail.org.uk ESMTP NetIQ MailMarshal (v5.5.5.9) Ready>

1996 10:55:20.461 Got: <HELO alerts>

1996 10:55:20.461 message <250 mail.org.uk Hello alerts (10.0.2.24)>

1996 10:55:20.461 Got: <MAIL FROM: <alerts@org.uk>>

1996 10:55:20.461 message <250 sender ok <alerts@org.uk>>

1996 10:55:20.461 Got: <RCPT TO: <sioperations@org.uk>>

1996 10:55:20.461 Created temp mail file <D:MailMarshalIncoming~B000388a80.00000001.mml>

1996 10:55:20.461 message <250 Recipient ok <sioperations@org.uk>>

1996 10:55:20.461 Got: <DATA>

1996 10:55:20.461 message <354 send the mail data, end with .>

1996 10:55:20.461 Received Mail Message D:MailMarshalIncomingB000388a80.00000001.mml from 10.0.2.24, 319 bytes.

1996 10:55:20.461 message <250 B000388a80 Message accepted for delivery>

1996 10:55:20.461 Event - Error talking to client 10.0.2.24



Socket closed unexpectedly



Thus the e-mail is failing to be sent, can you advise? The external SMTP server has no problems with receiving any other address.

The external mail server is in this case an outgoing SMTP server (and not an incoming = receiving SMTP server)

Sorry I don't understand your answer.



Under Admin / SMTP Settings, we are using an external SMTP server as the default mail server (for alerts).

Yes but this needs to be an outgoing relay server and not an incoming SMTP server.

It is an outgoing relay server (It is MailMarshal from NetIQ).



It does work fine for our other monitoring product (WhatsUpGold) The ServersCheck box is an allowed relay client.



There are no routers / bridges between the two appliances that could cause any issues - just wondered if you knew why.

Sorry but we are not familiar with all mail servers out there. We have not seen an issue like the one you report being reported.



Do you have additional information about following line:

Error talking to client 10.0.2.24 ?



Does the internal mail server option work or not? (as a temporary solution to address the other issue).

From MailMarshal tech - seems you are not handling SMTP correctly:



Error: 'Network transport error. Error talking to client <IP Address>. Socket closed unexpectedly'.

Article ID: NETIQKB35037



First Published: October 17, 2003

Last Reviewed: July 1, 2004



Affected Environments



NetIQ MailMarshal SMTP 5.5





Symptoms

Several 'Network Transport' errors appear in the NT Event Viewer Application log.



The following error message is displayed in the NT Event Viewer Application log:



Type: Warning

Source: MMReceiver

Event ID 3504



Description

Network transport error. Error talking to client <IP Address>

Socket closed unexpectedly





The following error message is displayed in the MailMarshal Receiver log:



1664 00:54:37.914 Event - Error talking to client <IP Address>

Socket closed unexpectedly







Cause

This issue occurs when:

A spamming server sends a spam email to the MailMarshal server.

The sending server immediately drops the connection without a formal quit response.

The MailMarshal Receiver logs this as a 'Network Transport Error' in the NT Event Viewer Application log.





Solution

There is not much that MailMarshal can do about these connection drops, since the remote sending server is abruptly dropping the connection. As long as email is flowing through MailMarshal, these errors are harmless. If email is not flowing through MailMarshal, please contact NetIQ Technical Support for further assistance.

What this tells is for incoming SMTP mails. cfr "the sending server immediately..." There is a difference between outgoing SMTP relay servers and incoming SMTP servers as these behave differently.



The above would apply if the option of the "Internal Mail Server" in ServersCheck is set (probably the way your other product works).

Ok, so if the internal mail server was selected, then HOW do you set the server that ServersCheck relays its mail to?

The Internal Mail Server option connects to the configured DNS server in your network card IP settings and then looks up the MX record and then delivers the email to the server corresponding to the MX record entry.



As such ServersCheck behaves as a mail server as described in the above document from NetIQ you quoted from.



With the External Mail Server option ServersCheck behaves as an email client (like Outlook) to send out emails (and such not as mail server).