Cisco Cisco Content Security Management Appliance M390 Guía Para Resolver Problemas
Wed Aug 20 22:25:07 2014 Info: Message aborted MID 1558778 Receiving aborted
Wed Aug 20 22:25:07 2014 Info: Message finished MID 1558778 aborted
Wed Aug 20 22:25:07 2014 Info: Message finished MID 1558778 aborted
What does "Receiving aborted by sender" in the mail logs
mean?
mean?
"MID XXX Receiving aborted by sender" indicates that it is the sender side that sent a "quit" before "data" to
end a SMTP conversation. "MID XXX" is the message ID of the message that could not be successfully
injected.
end a SMTP conversation. "MID XXX" is the message ID of the message that could not be successfully
injected.
The following example illustrates a remote client establishing a SMTP connection to the ESA followed by the
client side closing the connection at the application layer with the SMTP command "quit":
client side closing the connection at the application layer with the SMTP command "quit":
Thu Aug 14 13:08:49 2014 Info: New SMTP ICID 10318 interface Management
(192.168.0.199) address 192.168.0.200 reverse dns host ns.example.com verified no
Thu Aug 14 13:08:49 2014 Info: ICID 10318 RELAY SG RELAY_SG match 192.168.0.200
SBRS not enabled
Thu Aug 14 13:08:56 2014 Info: Start MID 1412 ICID 10318
Thu Aug 14 13:08:56 2014 Info: MID 1412 ICID 10318 From: <user@domain.com>
Thu Aug 14 13:09:03 2014 Info: MID 1412 ICID 10318 RID 0 To: <end_user@example.com>
Thu Aug 14 13:09:06 2014 Info: Message aborted MID 1412 Receiving aborted by sender
Thu Aug 14 13:09:06 2014 Info: Message finished MID 1412 aborted
Thu Aug 14 13:09:06 2014 Info: Message aborted MID 1412 Receiving aborted by sender
Thu Aug 14 13:09:06 2014 Info: Message finished MID 1412 aborted
Thu Aug 14 13:09:06 2014 Info: ICID 10318 close
Troubleshoot
To investigate further, set up injection debug logs for the mail server of the partner domain in
question. Injection debug logs will show you exactly what you get from that host to the appliance.
question. Injection debug logs will show you exactly what you get from that host to the appliance.
Note
: You may need to configure injection debug logs for each mail host listed in the partner's DNS
MX records.
•
You may also find it benefical to run a packet capture on the appliance during communication to
show the complete connection and handshake, and associated issues that may be causing the
connection to be inturrupted.
show the complete connection and handshake, and associated issues that may be causing the
connection to be inturrupted.
•
Related Information
Cisco Email Security Appliance - End-User Guides
•
What is a Message ID (MID), Injection Connection ID (ICID), or Delivery Connection ID
(DCID)?
(DCID)?
•
How do you analyze intermittent mail delivery issues on the ESA?
•
ESA Packet Capture Procedures
•
Technical Support & Documentation - Cisco Systems
•
Updated: Aug 14, 2015
Document ID: 118295