Gathering together all SMTP records related to a single email message from the SMTP log
Problem reported by Rod Strumbel - 2/26/2019 at 2:34 PM
What is the proper method to do this in SM?

The way I would have done this in our prior email server (CGP) would be to locate some record related to the message you want to examine... (typically by from or to address and time of day)...  from that record grab the Message ID... then run that Message ID in the search operation... poof, all records associated with that message appear.

If I try that method using the SM SMTP logs, I get tons of totally unrelated SMTP records all seemingly stamped with the Message ID I'm searching for, I can't explain it unless the field I think is the message ID isn't.

If someone from SM can respond, I can send a thorough example demonstrating what I'm talking about.

For the public, here is an SMTP log ecord, the hilited field I am using as the Message ID in my 2nd search hoping to get all the related SMTP messages for just that message:


5 Replies

Reply to Thread
Tim DeMeza Replied
Rod, this is exactly how I would do it as well.  However, I am not seeing the issues you are referring to.
Rod Strumbel Replied
Yeah... I'm really hoping to get some SmarterMail tech input on this one so I can send them a real example.
It is really frustrating trying to track things down for troubleshooting right now.

I figure there may be MANY others with this issue too, hence why not just opening a ticket at this time.
Sébastien Riccio Replied
Looking up SMTP logs with related traffic used to work for us, but since build 6970 I think it's broken. It now returns a lot of unrelated lines.

Only a guess but it might be related to this fix in 6970:
Fixed: Searching logs for Related Traffic on servers with non-US date/time formatting returns no results. 

ps: we are using non-US date/time formatting and it was working well until now, so I don't understand the fix.

To have a hint if it can be related. Are you @Tim DeMeza and @Rod Strumbel using the same date/time formattiing ?

ps: i've opened a ticket about it
Sébastien Riccio System & Network Admin https://swisscenter.com
Derek Curtis Replied
Employee Post
Rod -- I'm not seeing the issue either. When I search for a message ID (your example showed the message ID) and use Related Traffic, I only get results for that message ID in the results. This is running a more recent build than you, but we haven't touched that area. 

Sebastien, I do see the issue you're referencing in the last 16.x build. However, I'm not sure we'll get a fix out unless there's another public release of 16.x. That's TBD at this point. 
Derek Curtis COO SmarterTools Inc. www.smartertools.com
Rod Strumbel Replied
Derek, can I send you an example so you can see if you agree with what I am seeing?  Maybe I am mis-interpreting it.


Reply to Thread