Some messages show "Sender aborted connection" in SMG's audit logs.

Products

• Messaging Gateway

Issue/Introduction

Messages from some or all sources are delayed or fail to be delivered. When searching the Message Audit Logs for the sending IP via the Control Center Status > Message Audit Logs you find:

• Message audit logs shows "Sender aborted connection" as the action for these messages.
• Audit entries for messages with the "abort message" verdict show the mail sender.
• Audit entries for messages with the "abort message" verdict shows the subject as "(none)"

Resolution

The "Sender abort message" action is logged when the sender quit the SMTP session before delivering the full message.

• Confirm no network appliance is intercepting the SMTP connection between the sender and SMG
• Confirm the sender is not ending the SMTP session before delivering the full message

If you need to engage Broadcom support to assist in investigating the issue, please collect the following information in order to facilitate the investigation:

1. Set the "Brightmail Engine" and "Mail Transfer Agent" logs to "Information" level (Administration > Logs)
2. Collect a packet capture as described in TCPDUMP usage on Messaging Gateway 10.7.4 and newer
3. Once the packet capture is complete, collect a diagnostics as described in How to gather a diagnostic from the Messaging Gateway

Additional Information

For "Abort message" action, see the article Some messages show "Abort message" in SMG's audit logs.