In the SmtpPrevent_operational0.log, the following error appears repeatedly:

[SEVERE] (SMTP_CONNECTION.5204) Peer disconnected unexpectedly

This error occurs whenever an SMTP connection is terminated by the other party (the source or destination mail server).

The source and destination IP addresses are usually not present in this message. However, you can use the tid= and cid= values in the log message to correlate this error with other messages from the same connection. The addresses are in the form: [local|remote]=<address>:<port> . If the local port is 25, the connection is inbound to the Prevent server; if the remote port is 25, the connection is outbound from Prevent to an MTA.

For isolated cases, this error can appear during normal operation. If the error appears repeatedly and continuously, then there may be a network problem between the Prevent server and the source or destination MTA, or the MTA may be refusing connections.

If you are using the Prevent server with any type of load-balancing software or hardware, this error may be caused by the load balancer making test connections to port 25, to determine whether the server is "alive." In many cases, the load balancer closes the connection without sending any valid SMTP data. This causes a 5204 error message for each connection, and while it may not interfere with normal operation, it causes "noise" in the logs and can complicate troubleshooting.

For more information on error messages in SMTP Prevent, see the Article ID: 160811 - Email Prevent Diagnostics and Troubleshooting.