Some messages show "Abort message" in SMG's audit logs.

Products

• Messaging Gateway

Issue/Introduction

Messages from some or all sources are delayed or fail to be delivered. When searching the Message Audit Logs for the sending IP via the Control Center Status > Message Audit Logs you find:

• Message audit logs shows "Abort message" as the action for some external mail sources.
• Audit entries for messages with the "abort message" verdict show both the mail sender and recipient.
• Audit entries for messages with the "abort message" verdict shows the subject as "(none)"

Cause

Potential causes:

• An intermediate firewall device scanning the email content and resetting the SMTP connection when it fails the content scan.
• An application server not properly implementing the SMTP protocol.

Resolution

The "abort message" action is logged when there is an interruption of the SMTP mail delivery either from a connection timeout or due to an SMTP protocol violation by the sending server. 

• Confirm the operation of internal firewalls which may be intercepting the SMTP communication between the sending server and Messaging Gateway.
• Confirm that any application server which is sending to SMG properly implements the SMTP protocol.

If you need to engage Broadcom support to assist in investigating the issue, please collect the following information in order to facilitate the investigation:

1. Set the "Brightmail Engine" and "Mail Transfer Agent" logs to "Information" level (Administration > Logs)
2. Collect a packet capture as described in TCPDUMP usage on Messaging Gateway 10.7.4 and newer
3. Once the packet capture is complete, collect a diagnostics as described in How to gather a diagnostic from the Messaging Gateway

Additional Information

For "protocol deviation" related delivery issues, also see this article: "421 esmtp: protocol deviation" and "Abort" action for inbound messages listed in Message Audit Logs