Have You Checked Your SMTP Mailbox Temporary Tables Lately?

We have an Exchange Server2003 environment with afront-end and back-endinfrastructure. There are dedicatedbridgehead servers for incoming andoutgoing email traffic. Symantec MailSecurity 4.6 for Microsoft Exchange isinstalled on all our Exchange servers.Recently, I was troubleshooting anotherproblem and discovered that one bridgehead server was holdingnumerous emails in the SMTP mailbox temporary tables. When thebridgehead SMTP service was re-started, users notified our SupportCenter that they were receiving oldemail messages. So, I initiated a callwith Microsoft Product Support Services (PSS). When I was trouble-shooting this problem with PSS, Idiscovered that whenever event ID348 occurred (which has the errormessage A message could not be virusscanned – this operation will be retriedlater), email messages became stuckinside the SMTP mailbox temporarytables. Although this event came fromExchange, I later learned that whenMail Security can’t scan email messages, it logs those events and themessages are stored in the SMTPmailbox temporary tables. If you’reunfamiliar with the SMTP mailboxand other special Exchange Servermailboxes, Evan Dodds has done anexceptional job explaining them in thethree-part “Exchange Special Mailboxes” blog at http://blogs.technet.com/evand/archive/2004/12.aspx.

When email messages are stuck in SMTP mailbox temporary tables, you can’t use Outlook or other email clients to view them. You have to use a tool called Microsoft Foundation Classes MAPI (MFCMAPI). The Microsoft article “MFCMAPI demonstrates MAPI client code” (http://support.microsoft.com/?kb=291794) contains information about this tool as well as a link to download it.

MFCMAPI doesn’t have good documentation. So, if you want to look atwhat’s inside your SMTP mailboxtemporary tables, follow these steps:

I worked with PSS and Symantecrepresentatives to make sure futureemail messages didn’t get stuck in thetemporary tables. Following theinstructions in the Symantec article“Error: ‘A message could not be virusscanned - this operation will be retriedlater.’ Event ID 348” (document ID 2004102615323554), I ended up makinga couple of changes in the registry. Basically, I increased the timeoutperiod and the number of inputthreads available to the Mail Securityprocess. After the registry changes, Ire-created the Exchange database onour bridgehead server. Because thisdatabase didn’t have any user mailboxes, I didn’t have any problems.(Had the problematic Exchange database been on the mailbox server, Iwould have given a lot more thoughtbefore deciding to re-create the database.)

Nowadays, whenever I restart theSMTP service, I always check theevent log for event ID 348 and theSMTP mailbox temporary tables forstuck email messages. I haven’t seeneither, so it appears the problem hasbeen fixed.
—Brian Ko