IMS Traffic

[dennisbbb]

Looking at the "IMS Traffic" in Performance Monitor, I am confused by what I see.

On "Messages Entering MTS-IN", I am seeing average of 190
On "Messages Leaving MTS-OUT", I am seeing average of 50

Everything else appears normally low.

Is my server being used without my knowledge? Relaying is not allowed. I have only 200 users. Please shed some light on this one.

 

[georgeks]

what is the destination of these mesgs? Is it possible that your users are actually sending mesgs to these addresses, or do they look like spam?

 

[dennisbbb]

I cannot see where these messages go. I only get a graph in Performace Monitor. I have Trendmicro Virus scanner on Exchange and a Blackberry Enterprise Server.

I guess both of these servers constantly talk to each other because even in off hours, I get constantly:

On "Messages Entering MTS-IN", I get average of 60
On "Messages Leaving MTS-OUT", I get average of 20

Again, everything looks normal, it just bugs me to see such activities when presumably no one is using the email server. Just looking for answers.

 

[georgeks]

Check the chart options it may be in manual update i have periodic with 1000. also when you see these mesgs in traffic open exchange administrator go to ims and check the queues. Are there any mesgs in there outbound or inbound? Also check the logs in \exchsrvr\imcdata\log\ what do they say?

 

[dennisbbb]

Thanks for the reply guys.

The mail server is relay prohibited, but everyday I get about 40-50 items in the queue with <> originator. These are simply NDRs replies to spammers, due to unknown email address on the mail server.

The \log folder contain nothing suspicious and almost empty in off hours.

I guess the consistency of the averages indicates that there are internal processes among the Blackberry server, Trendmicro Scanmail and the Exchange server.

I see nothing else wrong with ther server since it's all updated and has been running for 5 years and counting.