Symantec Messaging Gateway Alert - Directory data service errors.

Products

• Messaging Gateway

Issue/Introduction

Symantec Messaging Gateway administrators may receive alerts or observe errors related to the Directory Data Service as below:

Timeouts and connection resets are found during integration with the LDAP data directory. The following errors or similar variations may be observed in the SMG logs:

WARN - [building membership: ###] [###] Unable to connect to ###/###.###.###.###:389
java.net.SocketException: Socket Closed

WARN - [building membership: ###] [###] 1 transient data access failures detected in past 120 seconds

[MembershipStoreFactory] ERROR - [building membership: ###] Failure while trying to resolve group membership
com.symantec.sms.dds.api.exception.DataAccessConnectionFailureException: Failure connecting to data source: ###  Reason: Socket Closed

[DDSSocketFactory] WARN - [PCT_LDAP] Unable to connect to ###/###.###.###.###:389
java.net.SocketTimeoutException: connect timed out

Cause

This is an environmental issue external to the Symantec Messaging Gateway. The logs indicate network timeouts (SocketTimeoutException) and unexpected connection terminations (Socket Closed), which are typically caused by:

Network instability or bandwidth limitations.

Packet drops or rejections caused by an intermediate network device (e.g., firewalls, load balancers, or IPS/IDS).

The target LDAP server reaching its maximum allowed connection limits, causing it to forcibly reject or close incoming Java socket connections.

Resolution

To resolve this issue, administrators should collaborate with their internal Network and Active Directory/LDAP teams.

Please perform the following troubleshooting steps:

1. Verify Network Stability: Ensure that the connection between the SMG appliance and the LDAP server is reliable and not subject to severe bandwidth limits or traffic shaping.

2. Check Intermediate Devices: Review the logs of any firewalls, routers, or load balancers situated between the SMG and the LDAP server. Ensure that no security policies or idle-timeout settings are silently dropping or rejecting the connection on port 389 (or 636 for LDAPS).

3. Investigate LDAP Connection Limits: Check the destination LDAP/Active Directory server to ensure it is not being overwhelmed by requests. If the server hits its MaxConnections threshold, it will reject new queries, resulting in the Socket Closed exceptions logged by SMG's Java processes. Increase the connection limit on the LDAP server if necessary.