Not using SMTP server, is instead trying to send directly using POPS

Question

Hi all,

Bit of a weird problem here, I have found that on some cases for some users our Service Desk is not sending emails by the configured SMTP server and is instead trying to send directly to the target users email server using POPS (995). I noticed this when I was tracing our firewall while sending the mail and I could see it use 995 at the moment I share the comment with the customer (and the customer does not receive the email). I am now blocking it but for some reason the Service Desk still thinks it has successfully sent the mail and it disappears from the Queue.

Our email configuration for the Services desk is plain SMTP (25) to our Email Relay which then passes it to O365 Exchange and then via an external email scanner. I cannot see it hit the Email Relay, O365 or the external email scanner. but i can see these Port 995 attempts being blocked.

Why would the service desk not be honouring the configured outgoing mail server and why on earth would it be defaulting to POPS?

Stumped!

Andy Heinzer · Answer

Hi Emile,

Jira has some default logging in regards to both inbound and outbound mail.  You can find these in the $JIRAHOME/log/ folder.   The log file will be named something like 'atlassian-outbound-jira.log'  and typically when these logs roll they get appended with a .1, .2, .3, etc extension.    Please let me know if we can be of any additional help here.

Andy

Emile Belcourt · Answer

Hello Andrew,

Makes sense now, still frustrating nonetheless to see an "answer" that isn't an answer.

I've taken packet captures from the firewall and wireshark on the server itself and can see around the time that i commit an action that there is a port 995 connection. Upon further examination I can see that the port 995 connection is actually to our IMAP service for the mailbox that it usually checks incoming mail from.

This is running in a Windows environment. Can you let me know where I can find any logs pertaining to emails in Jira? According the the Service Desk it is emptying the mail queue successfully but I cannot see those emails going anywhere, so where are they going.

Not too concerned about other connections right now, I want to find out what on earth Jira thinks it is doing with those emails because apparently they are delivered but I can find zero evidence of that being done.

I also updated the plugin manager just in case and it destroyed the Jira Service Desk and I had to revert to backup. That is an issue for another day.

Thanks,

Emile

Andy Heinzer · Answer

Hi Emile,

Anytime a user on Community clicks the "Answer" button to write a comment (or initial reply), that comment is treated as a possible Answer.  That is not to say this is the answer to your question necessarily, however all of these Answers have the ability to be upvoted and/or accepted as a solution.   If you click the checkbox next to an answer, that accepts it as a solution and the question will be marked as solved.   This is just how our Community site works.   I have not accepted my answer for this thread, but I could see how you might have received an email notification that your question now has an answer.   There just is not another way to comment to a question here without using the Answer button.

But back to the problem at hand here:  The plugins you have listed are all default user plugins that get installed when you have Jira and Jira Service Desk.  I don't think that any of those are responsible for this discrepancy.

How is it that you have determined that Jira is the one making this connection to port 995?  Is it just from looking at the firewall logs?   If so, then I think it would be best to try to return to the operating system running Jira and then we can run a few command line queries to try to determine exactly which process is opening that port.

The steps to do this are going to be different depending on the operating system you're using for Jira.  Are you running Jira on a Windows environment?  Or is this a Linux/Unix platform?

For Windows, try opening a command prompt (cmd.exe) and running this command:

netstat -a -b -n -o | find "995"

For Linux/Unix, open a terminal session

-w ':995'netstat -ntlp|grep

Of course for these commands to be useful, you are going to need to run these at or near the time that this machine is making that connection.

In Windows it should tell us the specific process name, in Linux I think this will at least give us the process id.   If Jira is truly the one opening this port, I would expect to see a process called either "java" or possibly "tomcat" as the process that has opened this connection.   I suspect that there might be something else at play here in this environment.  I don't know of anything within Jira's native code that would force the connection to the SMTP server to use any other setting than the one on that page.   So I am interested to learn if perhaps there is another process that could be responsible here for that connection instead of Jira.  Please let us know the results.