Entries in Delivery Log Missing Corresponding SMTP Log Entries
Question asked by Scott Hendrickson - 9/13/2015 at 2:14 PM
We're running SmarterMail 14.0.5661.  Recently I noticed that, while checking on the activity of an account that triggered our lowest abuse notification, I saw entries in the delivery log (not abuse as it turns out) but nothing in the SMTP log for the time in question.  At first I thought perhaps he used webmail, but upon logging into his webmail via impersonation, I found nothing even close the time period in question.  What I did find for that time were login entries for his account in the Admin log, but in the SMTP log, nadda. 
My understanding has always been that, regardless of whether it's an email client program on a PC, tablet, or phone, and regardless of whether the program/device is using POP or IMAP for retrieval, sending is still done via SMTP, isn't that right?  If that's the case, why would there be nothing in the SMTP log for that session??? 
Thanks guys! 
Scott Hendrickson
SOS4Net, Inc.
Centennial, CO. U.S.A.

3 Replies

Reply to Thread
Bruce Barnes Replied
SMTP logs show traffic ONLY when SENDING or RECEIVING e-mail

Are the SMTP logs set to DETAILED?
Is SMTP authentication disabled or bypassed for the domain?
When someone uses POP or IMAP to pull mail down to a client or device, there is nothing shown in the SMTP logs.
Bruce Barnes ChicagoNetTech Inc brucecnt@comcast.net Phonr: (773) 491-9019 Phone: (224) 444-0169 E-Mail and DNS Security Specialist Network Security Specialist Customer Service Portal: https://portal.chicagonettech.com Website: https://www.ChicagoNetTech.com Security Blog: http://networkbastion.blogspot.com/ Web and E-Mail Hosting, E-Mail Security and Consulting
Scott Hendrickson Replied
I discovered that the user in question uses webmail only.  I saw his login in the Admin log, which I assume is him logging into webmail because it's at the same time, but I guess it could be a cell phone or tablet, I'm not certain.  However from the Admin log I got his IP, and that IP doesn't appear in the IMAP or SMTP logs anywhere on that day. 
Does SmarterMail not log ANY webmail activity in the SmarterMail logs?  Is the only log we have for that the IIS logs?  What the heck good is that???  I don't know about you, but I do not enjoy going through IIS logs. 
Scott Hendrickson SOS4Net, Inc. Centennial, CO. U.S.A.
Joe Wolf Replied
They won't be in the SMTP logs, they'll be in the IIS logs.
Thanks, -Joe

Reply to Thread