Not using SMTP server, is instead trying to send directly using POPS

[Emile Belcourt]

Hi all,

Bit of a weird problem here, I have found that on some cases for some users our Service Desk is not sending emails by the configured SMTP server and is instead trying to send directly to the target users email server using POPS (995). I noticed this when I was tracing our firewall while sending the mail and I could see it use 995 at the moment I share the comment with the customer (and the customer does not receive the email). I am now blocking it but for some reason the Service Desk still thinks it has successfully sent the mail and it disappears from the Queue.

Our email configuration for the Services desk is plain SMTP (25) to our Email Relay which then passes it to O365 Exchange and then via an external email scanner. I cannot see it hit the Email Relay, O365 or the external email scanner. but i can see these Port 995 attempts being blocked.

Why would the service desk not be honouring the configured outgoing mail server and why on earth would it be defaulting to POPS?

Stumped!

[Andy Heinzer]

This sounds confusing.   Could you let us know exactly what settings are defined in Jira's Outgoing mail settings?   You should be able to navigate to Cog Icon -> System -> Outgoing mail, or visit /secure/admin/UpdateSmtpMailServer!default.jspa

From there, if you try to edit this and grab a screenshot of these settings it might help us understand this better.

Jira should be honoring the settings here in regards to making outbound SMTP connections.  The things I would be interested to learn here include, "Are you using a JNDI Location option on that page"?   This is an alternative way to define an SMTP server on this page.  Most instances of Jira I see never use this, but I'm curious.

If you're not using a JNDI here, and the SMTP port is set to port 25 here, then the next question I have is in regards to what other plugins might be installed with Jira.  There are some 3rd party plugins to Jira that in theory could be configured to use a different outbound email server for one reason or another.   Try going to Add-ons -> Manage Add-ons and let me know what User plugins are installed on this instance.  Perhaps this can help us to narrow the focus here.

[Emile Belcourt]

Hello Andrew,

The outgoing settings are our internal mail relay server on port 25 with no authentication (mail relay is restricted by specific internal IP). There is no configuration for anything other than this and it is not honouring the settings.

The settings are attached.

The only plugins installed on top of the base are:

• Atlassian Universal Plugin Manager
• Atlassian Troubleshooting and Support Tools
• Jira Working Hours Plugin
• psmq-plugin (not sure where this came from, could this be the cause? I disabled but there is no change)
• Service Desk Internal Base Plugin

I can see when I do a test mail, I can track all the data running on port 25. But when I add a comment to a case, create a new case or make any changes that would send an email, I can see in our firewall that the Jira Service desk is attempting connections to a remote IP on port 995.

Could you also deselect your reply as an answer as you have not actually answered my issue? Unless that is how this system works.

Many thanks,

Emile

[Andy Heinzer]

Hi Emile,

Anytime a user on Community clicks the "Answer" button to write a comment (or initial reply), that comment is treated as a possible Answer.  That is not to say this is the answer to your question necessarily, however all of these Answers have the ability to be upvoted and/or accepted as a solution.   If you click the checkbox next to an answer, that accepts it as a solution and the question will be marked as solved.   This is just how our Community site works.   I have not accepted my answer for this thread, but I could see how you might have received an email notification that your question now has an answer.   There just is not another way to comment to a question here without using the Answer button.

But back to the problem at hand here:  The plugins you have listed are all default user plugins that get installed when you have Jira and Jira Service Desk.  I don't think that any of those are responsible for this discrepancy.

How is it that you have determined that Jira is the one making this connection to port 995?  Is it just from looking at the firewall logs?   If so, then I think it would be best to try to return to the operating system running Jira and then we can run a few command line queries to try to determine exactly which process is opening that port.

The steps to do this are going to be different depending on the operating system you're using for Jira.  Are you running Jira on a Windows environment?  Or is this a Linux/Unix platform?

For Windows, try opening a command prompt (cmd.exe) and running this command:

netstat -a -b -n -o | find "995"

For Linux/Unix, open a terminal session

netstat -ntlp|grep -w ':995'

Of course for these commands to be useful, you are going to need to run these at or near the time that this machine is making that connection.

In Windows it should tell us the specific process name, in Linux I think this will at least give us the process id.   If Jira is truly the one opening this port, I would expect to see a process called either "java" or possibly "tomcat" as the process that has opened this connection.   I suspect that there might be something else at play here in this environment.  I don't know of anything within Jira's native code that would force the connection to the SMTP server to use any other setting than the one on that page.   So I am interested to learn if perhaps there is another process that could be responsible here for that connection instead of Jira.  Please let us know the results.

[Emile Belcourt]

Hello Andrew,

Makes sense now, still frustrating nonetheless to see an "answer" that isn't an answer.

I've taken packet captures from the firewall and wireshark on the server itself and can see around the time that i commit an action that there is a port 995 connection. Upon further examination I can see that the port 995 connection is actually to our IMAP service for the mailbox that it usually checks incoming mail from.

This is running in a Windows environment. Can you let me know where I can find any logs pertaining to emails in Jira? According the the Service Desk it is emptying the mail queue successfully but I cannot see those emails going anywhere, so where are they going.

Not too concerned about other connections right now, I want to find out what on earth Jira thinks it is doing with those emails because apparently they are delivered but I can find zero evidence of that being done.

I also updated the plugin manager just in case and it destroyed the Jira Service Desk and I had to revert to backup. That is an issue for another day.

Thanks,

Emile

[Andy Heinzer]

Hi Emile,

Jira has some default logging in regards to both inbound and outbound mail.  You can find these in the $JIRAHOME/log/ folder.   The log file will be named something like 'atlassian-outbound-jira.log'  and typically when these logs roll they get appended with a .1, .2, .3, etc extension.    Please let me know if we can be of any additional help here.

Andy