Unhandled rejection phase 15 errors in Messaging Gateway logs

Products

• Messaging Gateway

Issue/Introduction

Unhandled rejection phase 15 events appear in error logs for Symantec Messaging Gateway (SMG).

2018 Mar 14 19:28:59 PDT (err) ecelerity: [23103] [error]: SMS_AUDITLOGGER-01992: Unhandled rejection phase 15
2018 Mar 14 19:28:59 PDT (err) ecelerity: [23103] [error]: SMS_AUDITLOGGER-02001: Error handling rejection event.

Cause

These errors occur when a sender attempts to start a TLS connection but does not complete the handshake and then the connection is rejected, usually due to timeout. While these errors can arise due to general network issues that cause the TLS handshake to fail, research has shown that the usual culprit is a non-valid mail sender that is not adhereing to appropriate connection protocols for closing message transactions. For the latter, this error can be ignored.

Resolution

More information is available at the Information logging level:

1. Click Administration.
2. Click Logs in the left pane.
3. Set Mail Transfer Agent to Information.
4. Click the Save button (Note: this will restart the MTA and scanning components).

With Information logging, the unhandled rejection errors are followed by an ML-HOST_DISCONNECTED log entry, which indicates the IP:port that caused the error:

2018 Mar 20 08:42:35 PDT (err) ecelerity: [11605] [error]: SMS_AUDITLOGGER-01992: Unhandled rejection phase 15
2018 Mar 20 08:42:35 PDT (err) ecelerity: [11605] [error]: SMS_AUDITLOGGER-02001: Error handling rejection event.
2018 Mar 20 08:42:35 PDT (info) ecelerity: [11605] ML-HOST_DISCONNECTED: ###.###.###.###:17667 disconnected. (ID <hexnumber>)

The IP can be used to review IP Reputation or Message Audit Logs, or to further investigate at the network level.

More information on IP Reputation lookup:
https://support.symantec.com/en_US/article.HOWTO126849.html

More information on Message Audit Logs:
https://support.symantec.com/en_US/article.HOWTO126091.html