Can someone help me understand this, I have a user submitting e-mails to our IronPort appliances and only the first of multiple recipients are receiving the e-mails. He indicates that he has not changed anything and it has worked in the past...
I can verify that his e-mails were going to multiple people in the past and currently they are only going to one recipient.
Here is the message from the logs:
Mon Aug 27 08:11:01 2012 Info: Message done DCID 40967624 MID 117464191 to RID  [('from',
It's impossible to tell from just that one log line. Look at the "MID xxx ICID xxx RID xxx To: " lines. If the message has only one recipient listed then that's all the SMTP transaction submitted. If the application author is adamant that his program is submitting more than one recipient then you can turn on injection debugging to see what's happening on the SMTP connection. This is described in the Using IronPort Injection Debug Logs section of the Daily Management Guide.