12-06-2010 12:05 PM
I'm getting weekly reports that include No User Information as one of the top senders. I see that these messages show no From: address. Some of these are bounce messages, but others are from internal mail servers sending reporting information. How do I change the Ironport so that sender information is required?
Thanks
12-06-2010 01:06 PM
Greetings,
You will sometimes find the user information shown as "No User Information" for these reports. This parameter relates to messages that have been relayed through the IronPort appliance without an Envelope-From address. These are typically bounce messages being sent by an internal host. This is not a defect or a critical issue. It is just the way your environment(internal host) is configured to send bounces.
The IronPort device has no control over this setting. Generally, your host will add a "mailer-daemon@domain.com" type address as the From message header for such bounce messages.
In short there is not really a way to force a specific identification that I am aware of.
Christopher C Smith
CSE
Cisco IronPort Customer Support
12-07-2010 06:20 AM
Thanks for the quick response. The bounce messages are understandable, but I'm also showing No User Information messages related to messages that I believe are being forwarded from a user on our internal mail host through the Ironport. I would expect the forwarded messages to have From: information. Any thoughts?
Thanks again,
Ken
12-08-2010 03:35 PM
Hi Ken,
So the big question here is do we know for a fact that the messages you reference, correlate to the figures your seeing. One way you could try to confirm this would be by searching the mail logs, specifically for null senders. The problem usually becomes one of history, as the available data in the mail logs may not go back far enough to allow you to compare it to the data your seeing for the statistics.
To start the messages you referred to should be checked to validate that they do have the correct information for the from field.
Christopher C Smith
CSE
Cisco IronPort Customer Support
12-09-2010 06:06 AM
Verifying the no sender information was my first step in troubleshooting. Over the weekend, which is when th
ese issues are more likely to come to light, our mail volume is very low. The 5
messages with no sender information appeared in the Top 10 senders report. I grepped the logs and found the messages by se
arching for the text "from: <>". Once I have the subject and recipient data, I then use our Notes server to identify the sender. From
that point I've been able to determine (just yesterday) that these messages are likely coming from a client that is not including the sender information. Once I identify the cause, I'll be putting controls in place to prevent this.
Thanks for the responses
12-09-2010 06:42 PM
Excellent trouble shooting!
Christopher C Smith
CSE
Cisco IronPort Customer Support
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide