Actions taken: Abort message (message timed out)

Products

• Messaging Gateway

Issue/Introduction

Entries appear in Message Audit Log searches with the Abort message (message timed out) action.

Time	From	To	Original Subject	Verdict(s)	Action(s)
Friday, Dec 15, 2023 08:30:34 AM PST	[email protected]	[email protected]	(none)		Abort message (message timed out)
Friday, Dec 15, 2023 08:27:39 AM PST	[email protected]	[email protected]	(none)		Abort message (message timed out)

Cause

The Message Audit Logs with "Actions taken: Abort message (message timed out)" describe a connection timeout where the Messaging Gateway did not receive a full SMTP delivery from the sending server. The sending server connected and started the SMTP transaction, but the network packets ceased to arrive before the transaction completed:

An example related Information level log for the transaction:

2022 Jan 01 01:01:01 -05 (info) ecelerity: [13391] ML-REJECT: Rejection on: 10.10.10.123:25, sent to host: 10.10.10.124:15154, Audit ID ac110023-b31ff7000000344f-d4-62ab7682d161, 421 4.4.2 service timed out.#015

The above log entry explained:

• ML-REJECT:
  
  • The connection was rejected because the Messaging Gateway did not receive any further communication from the sender before the full SMTP transaction completed. The Messaging Gateway reached its timeout threshold waiting for the next network packet to arrive. If looking at the network packets, this would result in an SMTP deferral response and a network RST (reset) packet.
• Rejection on: 10.10.10.123:25,
  • This is the Messaging Gateway IP that was communicating, the IP that issues the SMTP deferral and the RST packet.
• sent to host: 10.10.10.124:15154,
  • This is the sender IP that was communicating. The Messaging Gateway stopped receiving network packets from this IP and reached the timeout threshold, then sent the deferral response ("421 4.4.2 service timed out.")  and closed the network connection.
• Audit ID ac110023-b31ff7000000344f-d4-62ab7682d161,
  • This is the Audit ID that is used by Message Audit Logging, you can find this message transaction in Message Audit Logs using the Audit ID.
• 421 4.4.2 service timed out.
  • This is the deferral message that was sent to the unresponsive sender, declaring that they should try again later, before closing the network connection.

 

The above transaction would likely show an "Abort message (message timed out)" in the Message Audit Logs. As described above, the root cause is that the Messaging Gateway stopped receiving communications from the sender, and so closed the network stream as configured by the Session Timeout threshold.

 

Resolution

Investigate the network path that the message transactions take to determine what might be interfering with the communication.

Common causes are :

• Firewalls
• Load Balancers
• Problematic network cabling
• Problematic router/switch ports