We receive the message "receiveing aborted"

[fernandovargas1]

Hello everyone, since a few days we have been received the following error message in our logs.

26 May 2014 12:16:03 (GMT -05:00) Protocol SMTP interface Data 1 (IP x.x.x.x) on incoming connection (ICID 69032804) from sender IP
200.16.40.21. Reverse DNS host mail.abc.com verified yes.
26 May 2014 12:16:03 (GMT -05:00) (ICID 69032804) ACCEPT sender group WHITELIST match 200.16.40.21 SBRS 5.6
26 May 2014 12:16:03 (GMT -05:00) Start message 37232867 on incoming connection (ICID 69032804).
26 May 2014 12:16:03 (GMT -05:00) Message 37232867 enqueued on incoming connection (ICID 69032804) from juan@abc.com
26 May 2014 12:16:03 (GMT -05:00) Message 37232867 on incoming connection (ICID 69032804) added recipient (pedro@cd.com).
26 May 2014 12:28:23 (GMT -05:00) Incoming connection (ICID 69032804) lost.
26 May 2014 12:28:23 (GMT -05:00) Message 37232867 aborted: Receiving aborted 

This error only affects emails with an attachment, empty emails pass ok, do you have any idea of what we need to verify?

Thanks for your help

[Stephan Bayer]

Is SBRS score checking enabled on the mail flow policy that is linked to sender group WHITELIST?

Do you have any message filters with an action of drop? CLI> filters command...

[fernandovargas1]

Tnanks, this domain is in the whitelist, any idea?

[srussell]

Following is an article which explains this issue:

http://tools.cisco.com/squish/B7752

What you will probably need to do to determine the root cause is enable injection debug logging for these connections and after the next occurrence review these logs for the issue.

Chapter 34 of the AsyncOS user guide explains how to setup injection debug logging and log retrieval methods:

http://www.cisco.com/c/dam/en/us/td/docs/security/esa/esa8-0/user_guide/ESA_8-0-1_User_Guide.pdf

[David Marinoff]

We suffered from Recieving Aborted messages on a very small subset of our messages and this was related to having packet inspection enabled on our firewalls for SMTP (default setting).  Once disabled, these messages immediately begun delivery.

David

[fernandovargas1]

Thanks David, i received the evidence from the telecom colleagues and this option is not enabled, any idea?