Author: W B Hacker Date: To: exim-users Subject: Re: [exim] Lots of "incomplete transaction (RSET)" messages appearing
Richard Hobbs wrote:
> Hello,
>
> Our mail server has been up for 259 days now, and in the last few days we
> have started to see emails go missing. They leave the mail client, and the
> client thinks the email has been sent. However, quite a few of the emails
> are never being received.
>
> Our logs show lots of entries like this:
>
> ============================================================
> ./mainlog.1:2006-03-06 18:51:24 H=dhcp-198.crl.toshiba.co.uk (STGR1004)
> [192.168.3.198] incomplete transaction (RSET) from <usera@???> for
> userb@???
> ./mainlog.1:2006-03-06 18:51:24 H=dhcp-198.crl.toshiba.co.uk (STGR1004)
> [192.168.3.198] incomplete transaction (RSET) from <usera@???> for
> userc@???
> ./mainlog.1:2006-03-06 18:51:25 H=dhcp-198.crl.toshiba.co.uk (STGR1004)
> [192.168.3.198] incomplete transaction (RSET) from <usera@???> for
> userd@???
> ./mainlog.1:2006-03-06 18:51:25 H=dhcp-198.crl.toshiba.co.uk (STGR1004)
> [192.168.3.198] incomplete transaction (RSET) from <usera@???> for
> usere@???
> ./mainlog.1:2006-03-06 18:51:25 H=dhcp-198.crl.toshiba.co.uk (STGR1004)
> [192.168.3.198] incomplete transaction (RSET) from <usera@???> for
> userf@???
> ============================================================
>
> Does anyone know what might be causing this problem?
Not really enough to go on. You might wish to enhance your
logging temporarily, 'log_selector = +all'.
Unless there has been a change in MUA or user's OS and/or
service pak or firewall settings, (checked already?) where I
would look first is to the condition of the apparent 'common'
shared link from 192.168.3.198 and any router/firewall(s) on it.
If 'no joy' otherwise, have a look at the connection with tcpdump.
Presuming WinWoes as the user OS, there is (or was once) also a
byte-by-byte log kept by WinWoes of communications transactions
- one that even lets you recover UID and passwords, as well as
the session handshakes. May need a Google or several to find
where that is kept, as I haven't had to do a police forensic
investigation in quite a while, don't otherwise use WinWoes, and
suffer from Irish Alzheimer's anyway. ;-)
Though you seem to have been spared, Exim 4.50 did have a few
'issues' that have long since been fixed/improved upon, so I
would also recommend an upgrade from 4.50 to at least 4.54 if
not 4.60.
