Some messages show "Sender aborted connection" in SMG's audit logs.

Products

• Messaging Gateway

Issue/Introduction

Messages from some or all sources are delayed or fail to be delivered. When searching the Message Audit Logs for the sending IP via Control Center > Status > Message Audit Logs, the following details appear:

• Message audit logs show "Sender aborted connection" as the action for these messages.
• Audit entries for messages with the "abort message" verdict show the mail sender.
• Audit entries for messages with the "abort message" verdict show the subject as "(none)".

Resolution

The "Sender abort message" action is logged when the sender quits the SMTP session before delivering the full message.

• Confirm no network appliance is intercepting the SMTP connection between the sender and SMG.
• Confirm the sender is not ending the SMTP session before delivering the full message.

If Broadcom support needs to be engaged to assist in investigating the issue, collect the following information to facilitate the investigation:

• Set the "Brightmail Engine" and "Mail Transfer Agent" logs to Information level (Administration > Logs).
• Collect a packet capture as described in TCPDUMP usage on Messaging Gateway 10.7.4 and newer.
• Reproduce the issue and confirm its occurrence by reviewing the Message Audit Logs.
• Collect screenshots of the audit logs as outlined in Collecting Message Audit Log details for a support case
• Once the packet capture is complete, collect diagnostics as described in How to gather a diagnostic from the Messaging Gateway.
• Revert log levels of "Brightmail Engine" and "Mail Transfer Agent" logs to their original levels to avoid unnecessary logging.
• Submit the collected diagnostic logs and audit log screenshots to the support ticket for further analysis as outlined in Uploading files to cases on the Broadcom Support Portal.

Additional Information

For "Abort message" action, see the article Some messages show "Abort message" in SMG's audit logs.