Error logs flooding hard drive. I think. Windows 2003.

[jazzdrive 0]

We are running Windows 2003 with Exchange 2003. However, none of the users have mailboxes set up, and out domain provider has not changed the domain settings to point toward our Exchange server. We can send mail from an account, so SMTP is working, but like I said, no one has a mailbox yet.

 

In the Event Viewer I am bombarded with the follwing logs. The recipients are slightly different each time.

 

Event Type: Error

Event Source: M[censored]changeTransport

Event Category: NDR

Event ID: 3030

Date: 1/5/2005

Time: 2:15:53 PM

User: N/A

Computer: MAINSERVER

Description:

A non-delivery report with a status code of 4.0.0 was generated for recipient rfc822;skinny@gigigaga.com (Message-ID <MAINSERVERox7nyeKzG00000215@connectky.org>).

 

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Data:

0000: d1 02 04 c0 Ñ..À

 

We also get lots of this similar one.

 

Event Type: Error

Event Source: M[censored]changeTransport

Event Category: NDR

Event ID: 3008

Date: 1/5/2005

Time: 2:12:11 PM

User: N/A

Computer: MAINSERVER

Description:

A non-delivery report with a status code of 5.0.0 was generated for recipient rfc822;luxwell@ethome.net.tw (Message-ID <MAINSERVERWStui3cJv00006609@connectky.org>).

Cause: This indicates a permanent failure. Possible causes : 1)No route is defined for a given address space. For example, an SMTP connector is configured, but this recipient address does not match the address spaces for which it routes mail. 2)Domain Name Server (DNS) returned an authoritative host not found for the domain. 3)The routing group does not have a connector defined û mail from one server in the routing group has no way to get to another routing group.

Solution: Verify that this error is not caused by a DNS lookup problem, and then check the address spaces configured on your STMP connectors. If you are delivering Internet mail through an SMTP connector, consider adding an address space of type SMTP with value ô*ö (an asterisk) to one of the SMTP connectors to make routing possible. Verify all routing groups are connected to each other through a routing group connector or another connector.

 

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

 

 

Are we being compromised in some way? Or is it nothing to worry about?

 

Also, in the Program Files\Exhchange\MDBDATA folder, it get's constantly filled up with E0000*.log files that are 5MB each. We get 80 of these in a couple of hours, which is costly, and I have to manually delete them every so often. IS this related. How can I stop it?

 

Thanks a lot for your help.

 

 

 

 

[jazzdrive 0]

Please does anyone know what I could do to stop this? I've stopped the Exchange services from running, but how will I solve this problem when we make the switch?

 

Also, The mailbox store database is be getting larger even though, like I said, no one is using it and there are no mailboxes configured.

 

 

Thanks for any help you can give.

[yakkob 0]

To help you out with the deletion of log files just add this batch script to run every 1/2 hour as a scheduled task:

 

erase "c:\Program Files\Exhchange\MDBDATA\E0000*.log"

 

So you can at least concentrate on the other problem.

 

HTH

[yakkob 0]

Ignore the above.

 

Do NOT set upthe batch script.

 

Refer to your other post with answers by Clutch, Dosfreak, apk.

 

Link courtesy of Dosfreak http://weblogs.asp.net/exchange/archive/2004/05/12/130556.aspx

[peterh 1]

It sounds like your Email server is being Spammed, you need to configure SMTP for your domain and disable Anonymous login for the SMTP Virtual servers.

 

See http://www.m[censored]change.org/tutorials/SMTP_Virtual_Server_Uncovered.html

 

[jazzdrive 0]

Yeah, I tried to disable anonymous access wherever I could, but they still kept coming. I don't know what I was doing wrong.

[jazzdrive 0]

Okay, I finally got the spamming to stop. However, the badmail folder is continuing to fill up. Any ideas on what it could be?

[Merlin_666 0]

Your Exchange server is most probably being used as relay server.

Check your firewall or router settings and see what open ports you have and to where they redirect.Also check as your server is not exposed as a DMZ.

 

[GTwannabe 0]

Badmail will continue to fill up; Microsoft doesn't provide a way to automatically delete it.

 

Here's a batch file I made for my Exchange server at work:

 

del "C:\Program Files\Exchsrvr\Mailroot\vsi 1\BadMail\*.*" /Q

 

Put that in a .bat file and schedule it to run early in the morning every day and you'll be fine.