Problems with releasing messages from a quarantine.

  • 7025025
  • 02-Mar-2021
  • 24-Mar-2021

Environment


GWAVA (Secure Messaging Gateway) 7

Situation

You have configured a Policy, for instance, to monitor outbound email traffic. Some outbound mails matched criteria set in defined filters and as admin you want to review those messages in a quarantine and release them.

Resolution

When releasing emails from a quarantine, you must first define a new entry in Module Management -> Mail Relay Module Manager. Here create some new entry and what needs to be defined/enabled are two options in a Delivery targets:

- Defined domains
- MX Targets



The first option serves for your own defined domains, example when you have configured email notifications that will be sent back to an internal sender or to an internal recipient informing him that his email was captured by some policy filter.
You can monitor such a process in relay host logs located in /vaastore/smg/services/logs/smg-relay-<number> directory. Here is an example of such notification email sent by the system (admin@sg7.com) back to an internal sender (u1@rum.com) that his mail was blocked:

[140667437090560] 2021-03-02 12:18:43 Found 1 new message to process
[140667225372416] 2021-03-02 12:18:43 Queue handler thread started
[140667225372416] 2021-03-02 12:18:43 Processing message: aab168ffe5d63344fc7f617b93b1d870.1g3s7mi.2
[140667225372416] 2021-03-02 12:18:43 Using domain target 147.2.77.227 for delivery for domain rum.com
[140667225372416] 2021-03-02 12:18:43 Establishing (direct) connection to 147.2.77.227
[140667225372416] 2021-03-02 12:18:43 Connected to SMTP server 147.2.77.227, delivering message
[140667225372416] 2021-03-02 12:18:43 [16] Initiating delivery to 1 recipient
[140667225372416] 2021-03-02 12:18:43 [16] 220 sles15 GroupWise Internet Agent 18.3.0 (C) Copyright 1993-2020 Micro Focus or one of its affiliates. Ready
[140667225372416] 2021-03-02 12:18:43 [16] EHLO GWAVAMailer
[140667225372416] 2021-03-02 12:18:43 [16] 250-sles15
[140667225372416] 2021-03-02 12:18:43 [16] 250-8BITMIME
[140667225372416] 2021-03-02 12:18:43 [16] 250-SIZE
[140667225372416] 2021-03-02 12:18:43 [16] 250-DSN
[140667225372416] 2021-03-02 12:18:43 [16] 250 STARTTLS
[140667225372416] 2021-03-02 12:18:43 [16] STARTTLS
[140667225372416] 2021-03-02 12:18:43 [16] 220 Ready to start TLS
[140667225372416] 2021-03-02 12:18:43 TLS negotiation completed [SSL:DHE-RSA-AES256-GCM-SHA384 256bit TLSv1.2]
[140667225372416] 2021-03-02 12:18:43 [16] EHLO GWAVAMailer
[140667225372416] 2021-03-02 12:18:43 [16] 250-sles15
[140667225372416] 2021-03-02 12:18:43 [16] 250-AUTH LOGIN
[140667225372416] 2021-03-02 12:18:43 [16] 250-8BITMIME
[140667225372416] 2021-03-02 12:18:43 [16] 250-SIZE
[140667225372416] 2021-03-02 12:18:43 [16] 250 DSN
[140667225372416] 2021-03-02 12:18:43 MAIL FROM:<admin@sg7.com>
[140667225372416] 2021-03-02 12:18:43 [16] 250 Ok
[140667225372416] 2021-03-02 12:18:43 [16] RCPT TO:<u1@rum.com>
[140667225372416] 2021-03-02 12:18:43 [16] 250 Ok
[140667225372416] 2021-03-02 12:18:43 [16] DATA
[140667225372416] 2021-03-02 12:18:43 [16] 354 Enter mail, end with "." on a line by itself
[140667225372416] 2021-03-02 12:18:43 .
[140667225372416] 2021-03-02 12:18:43 [16] 250 Ok
[140667225372416] 2021-03-02 12:18:43 [16] QUIT
[140667225372416] 2021-03-02 12:18:43 [16] 221 sles15 Closing transmission channel
[140667225372416] 2021-03-02 12:18:43 Processing complete: aab168ffe5d63344fc7f617b93b1d870.1g3s7mi.2
[140667225372416] 2021-03-02 12:18:43 Queue handler thread completed after processing 1 messages
[140667479054080] 2021-03-02 12:18:43 (CORE) Thread maintenance requested
[140667479054080] 2021-03-02 12:18:43 (CORE) Popping 1 items off queue
[140667479054080] 2021-03-02 12:18:43 (CORE) Thread maintenance complete

The second option, MX targets relies on DNS information about a target (recipient) Internet domain. Then you would see how the released outbound message (from u1@rum.com) was passed to the target domain (recipient u1@techpreview.com):

[140667437090560] 2021-03-02 12:19:15 Found 1 new message to process
[140667225372416] 2021-03-02 12:19:15 Queue handler thread started
[140667225372416] 2021-03-02 12:19:15 Processing message: aab168ffe5d63344fc7f617b93b1d870.1g3s7mg.1
[140667225372416] 2021-03-02 12:19:15 Using mx record techprev.techpreview.com for domain techpreview.com
[140667225372416] 2021-03-02 12:19:15 Establishing (direct) connection to techprev.techpreview.com
[140667225372416] 2021-03-02 12:19:15 Connected to SMTP server techprev.techpreview.com, delivering message
[140667225372416] 2021-03-02 12:19:15 [16] Initiating delivery to 1 recipient
[140667225372416] 2021-03-02 12:19:15 [16] 220 techpreview.com GroupWise Internet Agent 18.3.0 (C) Copyright 1993-2020 Micro Focus or one of its affiliates. Ready
[140667225372416] 2021-03-02 12:19:15 [16] EHLO GWAVAMailer
[140667225372416] 2021-03-02 12:19:15 [16] 250-techpreview.com
[140667225372416] 2021-03-02 12:19:15 [16] 250-8BITMIME
[140667225372416] 2021-03-02 12:19:15 [16] 250-SIZE
[140667225372416] 2021-03-02 12:19:15 [16] 250-DSN
[140667225372416] 2021-03-02 12:19:15 [16] 250 STARTTLS
[140667225372416] 2021-03-02 12:19:15 MAIL FROM:<u1@rum.com>
[140667225372416] 2021-03-02 12:19:15 [16] 250 Ok
[140667225372416] 2021-03-02 12:19:15 [16] RCPT TO:<u1@techpreview.com>
[140667225372416] 2021-03-02 12:19:15 [16] 250 Ok
[140667225372416] 2021-03-02 12:19:15 [16] DATA
[140667225372416] 2021-03-02 12:19:15 [16] 354 Enter mail, end with "." on a line by itself
[140667225372416] 2021-03-02 12:19:15 .
[140667225372416] 2021-03-02 12:19:15 [16] 250 Ok
[140667225372416] 2021-03-02 12:19:15 [16] QUIT
[140667225372416] 2021-03-02 12:19:15 [16] 221 techpreview.com Closing transmission channel
[140667225372416] 2021-03-02 12:19:15 Processing complete: aab168ffe5d63344fc7f617b93b1d870.1g3s7mg.1
[140667225372416] 2021-03-02 12:19:15 Queue handler thread completed after processing 1 messages
[140667479054080] 2021-03-02 12:19:15 (CORE) Thread maintenance requested
[140667479054080] 2021-03-02 12:19:15 (CORE) Popping 1 items off queue
[140667479054080] 2021-03-02 12:19:15 (CORE) Thread maintenance complete

Sometimes you might see complaints like in the example below:

[140196092036864] 2021-03-02 11:48:57 Found 1 new message to process
[140196083644160] 2021-03-02 11:48:57 Queue handler thread started
[140196083644160] 2021-03-02 11:48:57 Processing message: aab168ffe5d63344fc7f617b93b1d870.1g3s5mn.1
[140196083644160] 2021-03-02 11:48:57 Delivery to domain techpreview.com was incomplete. No delivery targets were found.
[140196083644160] 2021-03-02 11:48:57 Message could not be fully delivered at this time and will be retried later
[140196083644160] 2021-03-02 11:48:57 Processing complete: aab168ffe5d63344fc7f617b93b1d870.1g3s5mn.1
[140196083644160] 2021-03-02 11:48:57 Queue handler thread completed after processing 1 messages
[140196134000384] 2021-03-02 11:48:57 (CORE) Thread maintenance requested
[140196134000384] 2021-03-02 11:48:57 (CORE) Popping 1 items off queue
[140196134000384] 2021-03-02 11:48:57 (CORE) Thread maintenance complete

and released message does not get delivered anywhere. In this case, a LAN trace was taken from a SMG host directly when an outbound message was released and a root cause was a wrong DNS entry for the target domain name on a DNS used by the SMG host. Such a background information can be viewed only from a LAN trace. It might be helpful when troubleshooting such failures as the relay log does not explicitly tell you what was here wrong, and was rather misleading.

Note, this relay settings works for sending notification emails, scheduled digests and releasing messages (in or outbound) from a quarantine. There is no SMTP target entry needed in the relay definition. SMG uses internal SMTP features.

Status

Top Issue