Not getting your Sharepoint Alerts?

I was working with another SBS consultant on an issue where the majority of his client sites were not receiving alerts from Sharepoint, not even the e-mail messages identifying that an alert had been created.

In a reversal of my usual approach, I’ll give you the solution, then tell you how we approached the troubleshooting.

Turns out that, based on a message from SBS MVP Les Connor that’s posted on SBS MVP Kevin Weilbacher’s site, my client had enabled the Filter Messages with Blank Sender in the Exchange System Manager Message Delivery section. Once we disabled that setting, the Sharepoint alerts started flowing as expected.

Alternately, you can set a From address in the Sharepoint Central Administration settings. From Administrative Tools, open Sharepoint Central Administration. Then go to Configure Virtual Server Settings, Companyweb, Virtual Server E-mail Settings, and enter a valid address in the From Address: field.

Now, how did we get there? First, we checked to make sure that the alerts were being generated at all. Sharepoint and the Sharepoint Timer Service send e-mail through the default SMTP virtual server. So we enabled logging on the SMTP virtual server and looked in the logs in C:\Windows\System32\LogFiles\SMTPSVC1 folder to see if the messages were being generated. Here’s a sample of what to look for in the SMTP log to see if the alerts are getting sent:

2005-11-04 20:56:23 192.168.16.2 sbs SMTPSVC1 SBS 192.168.16.2 0 HELO – +sbs 250 0 41 8 79 SMTP -
2005-11-04 20:56:23 192.168.16.2 sbs SMTPSVC1 SBS 192.168.16.2 0 MAIL – +FROM: 250 0 35 22 219 SMTP -
2005-11-04 20:56:23 192.168.16.2 sbs SMTPSVC1 SBS 192.168.16.2 0 RCPT – +TO: 250 0 0 33 62 SMTP -
2005-11-04 20:56:29 192.168.16.2 sbs SMTPSVC1 SBS 192.168.16.2 0 DATA – + 250 0 120 1279 5344 SMTP -
2005-11-04 20:56:29 192.168.16.2 sbs SMTPSVC1 SBS 192.168.16.2 0 QUIT – sbs 240 5750 63 4 0 SMTP -

Things to note about this transaction:
1. The incoming connection source IP is the internal IP address of the SBS server (in this case, 192.168.16.2).
2. The initial greeting is HELO, not EHLO (most mail systems use EHLO these days).
3. The FROM address is system at the SBS server name (in this case, ’system@sbs’).

The consultant was seeing these entries in the SMTP logs, so we knew that the messages were getting delivered to the SMTP service correctly.

Our next thought was that Trend Micro’s anti-spam software was getting in the way. So we looked at the Trend quarantine for spam, no messages there. Next, we uninstalled the ScanMail suite entirely, rebooted the server, and tested delivery. The alerts were getting to SMTP, but not to the mailbox.

That’s when the consultant pointed out the above-mentioned article and told me about the modifications he’d made to Exchange. I immediately was suspicious about the Filter Messages with Blank Sender setting, since the alert is coming from an unusual e-mail address, and when you look at the actual alert messages, the Sender field is blank.

The consultant tested this at several of his other sites, just changing the Filter Messages with Blank Sender setting and touching nothing else, and the alerts started coming through.

So then, I thought, “Surely, you can set the From address on the alerts in the Sharepoint configuration.” So I dug through the Sharepoint Central Administration site and found the settings page listed above.