Managed Availability: Outbound Authentication failed with TargetUnknown

  • Article

Recently I was working with Managed Availability that fired up the alert "Outbound Authentication failed with TargetUnknown" on the server SERVER01. Looking in the "ProbeResults" of Managed Availability crimson channel "Microsoft-Exchange-ActiveMonitoring/ProbeResult", probe was failing very often, but probe results didn't gave me much of information.

Testing server health didn't showed anything as "Unhealthy":

 Get-ServerHealth $env:COMPUTERNAME | Where-Object {$_.AlertValue -eq "Unhealhty"}

Probe results were still failing and SCOM fired alerts over and over again.

Since all SMTP sessions are stored in connectivity logs, checking it was next decision. Performed search of the latest connectivity log with pattern "Failed" and that gave me answer to my question, why probes are failing:

 [PS] C:\Windows\system32>Get-Content "C:\{ Exchange Install Path }\TransportRoles\Logs\Hub\Connectivity\CONNECTLOG20151219-1.LOG" | Select-String -Pattern "Failed"
   
2015-12-19T04:29:04.035Z,08D2F893AD59193C,SMTP,Failed connection to 192.168.100.2:717 (TimedOut:0000274C)[TargetHost:SERVER02.domain.com:717|MarkedUnhealthy|FailureCount:1|NextRetryTime:2015-12-19T04:30:04.035Z][TargetIPAddress:192.168.100.2:717|MarkedUnhealthy|FailureCount:1|NextRetryTime:2015-12-19T04:30:04.035Z]

Basically, probes were failing while SERVER01 tried to execute SMTP transaction to another server in same site - SERVER02. Tried telnet to SERVER02 on port 717 (Outbound Proxy Connector port), but connection was failing:

 [PS] C:\Windows\system32>telnet SERVER02 717
Connecting To SERVER02...Could not open connection to the host, on port 717: Connect failed

Checked transport service on SERVER02, and it was stopped:

 [PS] C:\Windows\system32>get-service *transport* -ComputerName SERVER02

Status   Name               DisplayName
------   ----               -----------
Stopped MSExchangeFront... Microsoft Exchange Frontend Transport

Started service on remote server and probe stopped firing alerts. Why Frontend Transport was stopped and why probe was not failing for that component on SERVER02 is part of another story.