00:00:00 INCOMPLETE-SESSION errors

[fbongartz]

Hello volunteers,

I'm trying to understand why an email never arrived at our zcs server. We have an external email provider who receives all mail for our domain and forwards them to our internal zimra mail server.

In their logs (merak mail server), they have the following at the time the message was sent (xxx.xxx.xxx.xxx is the sender's mta, yyy.yyy.yyy.yyy is the public ip of our zimbra server):

xxx.xxx.xxx.xxx   [0A80] 11:33:06 <<< MAIL FROM:<sender@senderdomain.com> SIZE=608505

xxx.xxx.xxx.xxx   [0A80] 11:33:06 >>> 250 2.1.0 <sender@senderdomain.com>... Sender ok

yyy.yyy.yyy.yyy  [0A80] 11:33:07 Client session >>> MAIL From:<sender@senderdomain.com>

yyy.yyy.yyy.yyy  [0A80] 11:33:07 Client session >>> MAIL From:<sender@senderdomain.com>

yyy.yyy.yyy.yyy  [0A80] 11:33:07 Client session >>> MAIL From:<sender@senderdomain.com>

SYSTEM          [0DB4] 11:33:08 Client session *** <sender@senderdomain.com> <recipient1@ourdomain.com> 1 608690
00:00:00 INCOMPLETE-SESSION HVF45507

SYSTEM          [0298] 11:33:08 Client session *** <sender@senderdomain.com> <recipient2@ourdomain.com> 1 608690
00:00:00 INCOMPLETE-SESSION HVF45507

xxx.xxx.xxx.xxx   [0A80] 11:33:08 *** <sender@senderdomain.com> <recipient1@ourdomain.com> 3 608505 00:00:00 OK HVF45507

SYSTEM          [0B78] 11:33:08 Client session *** <sender@senderdomain.com> <recipient3@ourdomain.com> 1 608690
00:00:00 INCOMPLETE-SESSION HVF45507

So I checked our logs at /var/log/zimbra.log. The only suspicious entry that was written roughly at the same time is the following:

Nov 24 11:34:28 mail postfix/anvil[3247]: statistics: max connection rate 5/60s for (smtp:zzz.zzz.zzz.zzz) at Nov 24 11:30:19
Nov 24 11:34:28 mail postfix/anvil[3247]: statistics: max connection count 2 for (smtp:zzz.zzz.zzz.zzz at Nov 24 11:29:45
Nov 24 11:34:28 mail postfix/anvil[3247]: statistics: max cache size 2 at Nov 24 11:25:11

(zzz.zzz.zzz.zzz is the public ip of our email provider's merak server)

My question is 1. are postfox/anvil's log entries errors or just normal statistics? And 2. any ideas on why the session would fail?

Cheers,

Fabrice

[phoenix]

Originally Posted by fbongartz

My question is 1. are postfox/anvil's log entries errors or just normal statistics?

They are just normal statistics and nothing to do with your problem.

Originally Posted by fbongartz

And 2. any ideas on why the session would fail?

Unfortunately I've no idea, I know nothing about Merak mail servers. That might be a question for a forum on Merak Mail Server or one of these links: +postfix +"INCOMPLETE-SESSION " - Yahoo! Search Results Are you sure the recipient actually exists in the Zimbra mail server (see the last link in the search I've given you above)?

[fbongartz]

Originally Posted by phoenix

They are just normal statistics and nothing to do with your problem.

Ah, good to know. Thank you.

Originally Posted by phoenix

Unfortunately I've no idea, I know nothing about Merak mail servers. That might be a question for a forum on Merak Mail Server or one of these links: +postfix +"INCOMPLETE-SESSION " - Yahoo! Search Results Are you sure the recipient actually exists in the Zimbra mail server (see the last link in the search I've given you above)?

Yes, the recipient exists. What's strange is that the problem seems to be sporadic in nature. Later that day, the exact same mail was successfully re-sent and received by the same recipients. Furthermore, there seems to be no hint at all regarding the problem in the zimbra logs, which leads me to believe that it's not our server that's doing something wrong.

I'm even considering connection problems or maybe some kind of firewall issue.

[phoenix]

Originally Posted by fbongartz

I'm even considering connection problems or maybe some kind of firewall issue.

As this event is (apparently) random and works sometimes and not others I'd also suspect it was a connection problem.