Some entries in the Message Audit Log (MAL) for Symantec Messaging Gateway (SMG) display "Abort message" as the Action, with no verdict.
This symptom occurs when an SMTP connection to SMG is interrupted during the message transmission and the email message was not successfully delivered to Messaging Gateway.
Possible underlying causes:
While you can resolve these symptoms in multiple ways, based on the underlying cause, Symantec recommends the order in which they appear.
From the control center, (Administration > Shutdown > Select a scanner host) Click Reboot.
From the command line, as admin, run "reboot" and type "yes" when prompted.
See Restarting the Symantec Messaging Gateway appliance with DRAC forcefully.
For directions specific to your firewall model, please contact your firewall manufacturer.
Though not recommended, you may also try to resolve the issue by increasing the Connection Timeout value for the SMTP conversation.
Note: Symantec does not recommend setting the Connection Timeout higher than 5 minutes.
Well-known examples of SMTP filtration features within non-Symantec firewall products include, but are not limited to:
If the default timeout of 30 seconds is exceeded, the appliance's MTA terminates the SMTP conversation before the entire DATA portion of the message is received. This behavior results in an Abort message action with partial entries in the Mail Audit Log.
Firewalls which scan or proxy SMTP traffic to ensure that the traffic is valid can hold the connection and cause it to fail. This issue is due to the timeout values built into the appliance MTA to prevent denial-of-service attacks. Firewall devices which do not support ESMTP commands may also cause disconnects.