I fucking hate users, here is how one wasted half of my last day out of the office on the xmas break.. He left on the last day so he put a forward on all his email to his new address, thing is he didn't test it! So he got an email and it forwarded it on, the server the other end didn't recognise it and so it came back, exchange saw that he had a new email and sent it back and it became a never ending loop. What do you think happened when he got more emails? The Admin inbox literally has millions of undeliverable message receipts where they were bouncing and going out again. It caused the McAfee Groupshield service to chew up all of the RAM on the server as it stacked them into a queue to check them as they went out and came in and in the end caused the entire database to die and the exchange services to stop. In the end I upgraded Groupshield to the newer McAfee Security for Microsoft Exchange as the database was fecked anyway. If anyone got anything that was blocked over the xmas period such as zipped files I won't be able to get them back as its a new database now. O well his fault. So after working out that this what was happening I had to clean up the mess. Sent my boss a moody email saying that we should bill the wanker as he doesn't work for us anymore and I ain't working for free!
I'm not really an Exchange guy but it seems kind of odd that a single user can bring down the server. Aren't their any protections in place for that kind of thing? Doesn't the admin box have a size limit?
There are size limits but it wasn't size that was the issue. It was the shear number of emails going out and coming in that overwhelmed the email virus security system. Normally if we have already had an email it would reject it but each item was a new email because it was a new rejection from the other server. Another way to explain it.. He recieved an email -> Exchange forwarded this to forwarding address -> Forwarding address didn't exist and so a message came back saying underliverable -> back to start It became a never ending loop of an email going out that then couldn't be delivered which caused their server to send a message telling the sender that it couldn't be delivered which was then forwarded on back to the server that couldn't accept it. Everytime he got a new email from a different person it started a new loop so in the end there could have been 100s of these loops going on which overwhelmed the system. It saw them all as new emails and in each case followed the rule to send them to a new address because that is what he told outlook to do. I don't see how you could tell Exchange to realise this is going on because it has no idea what is in the email and simply does as its told by sending them on. We are still running 2003 and plan to upgrade in the new year, perhaps newer versions have safeguards against this? Setting up a rule to reject all 'undeliverable' messages would be a bad idea because then people wouldn't know when they have entered an incorrect address for example.
Exactly the same thing happened like 5 years ago to one of newsgroups servers I was using. I went to holidays and set up the auto responder. Nowadays you have an option to set it "for all incoming messages" or "for messages from within the organization only" so you usually pick up the latter. But these days, I didn't realize that it could go so wrong. The scenario was exactly like yours. The first message from the newsgroups server hitting my inbox triggered the auto response message which then was also delivered to me and this started the mayhem. I guess the server was turned off (or went down) after 5 or 6 hours and about 20000 messages have been delivered, most from me but some from other people crying "please stop this madness" and these messages were of course appended to the queue. From what I know the server has been reconfigured (I don't know how exactly) to prevent such issues in future. Myself, I've stopped to use the autoresponse messages until one of next Exchanges introduced this "only within the organization" flag.
bet he did it on purpose and signed up for a ton of fecal fan newsletters, sounds like a typical asshole move.