Environment
Situation
Multiple copies of some emails are received with SMTP scanner
Resolution
If multiple copies of some emails are being received, we need to check the log files to find out why. One common cause of this is due to the sending server disconnecting while waiting for a response from GWAVA. This can be seen in the gwvsmtp log by following one of the instances of the received email through the log files (preferably one of the first mails received). The email will be received, scanned, and passed along to the GWIA, at which point GWAVA communicates with the sending email server to close the session so the email is received. If this scan process takes too long, some email servers will disconnect. This is evidenced in the log with the message "Socket read error: TCP session closed". In this case, GWIA has successfully received the email and will send it to the recipient, however, the sending email server has disconnected and so will try again later. This can happen multiple times for the same email.
Since we cannot change the time out on the sending server, we need to discover what is causing the scan to take so long. By speeding up the scan, we will prevent the server from disconnecting before verifying that it has successfully sent the mail. This shouldn't be necessary in most cases, as message scans happen in seconds. However, there are some problems that can cause scans to take 30 or more seconds. For example, GWAVA could be trying to do a SURBL or RBL lookup on the message, and that lookup may be failing. Careful review of the GWAVA log files will show what part of the message scan is taking so long. If an RBL lookup through one particular server is always causing this delay, then that server may not be functional anymore. Remove this RBL or SURBL server from the list of servers used, and this will speed up message scanning significantly, preventing duplicate copies of a message from being received.
Since the log files can be rather difficult to look through, support can help you find the reason for the scanning delay, and come up with a solution to speed things up.