Errors HM5136 and HM4208

Use this forum if you have installed hMailServer and want to ask a question related to a production release of hMailServer. Before posting, please read the troubleshooting guide. A large part of all reported issues are already described in detail here.
Post Reply
Grautvornix
New user
New user
Posts: 9
Joined: 2016-01-22 10:45

Errors HM5136 and HM4208

Post by Grautvornix » 2019-09-11 15:23

Hi all,

we're getting several errors HM5136 and HM4208 and >10 minidumps are written every day. It's always the same two messages

"ERROR" 3844 "2019-09-11 11:20:24.230" "Severity: 3 (Medium), Code: HM5136, Source: TCPConnection::AsyncReadCompleted, Description: An error occured while parsing data. Data length: 40, Data: A8 FETCH 77 (BODY.PEEK[]<31653.1048576>). Remote IP: 109..."
"ERROR" 3844 "2019-09-11 11:20:24.230" "Severity: 2 (High), Code: HM4208, Source: ExceptionHandler::Run, Description: An error occured while executing 'IOCPQueueWorkerTask'"
"ERROR" 3560 "2019-09-11 14:24:32.901" "Severity: 3 (Medium), Code: HM5136, Source: TCPConnection::AsyncReadCompleted, Description: An error occured while parsing data. Data length: 40, Data: A8 FETCH 77 (BODY.PEEK[]<31653.1048576>). Remote IP: 109..."
"ERROR" 3560 "2019-09-11 14:24:32.933" "Severity: 2 (High), Code: HM4208, Source: ExceptionHandler::Run, Description: An error occured while executing 'IOCPQueueWorkerTask'"
"ERROR" 3560 "2019-09-11 14:24:38.902" "Severity: 1 (Critical), Code: HM5519, Source: StackLogger::Log, Description: An error has been detected. A mini dump has been written to D:\MAIL\Logs\minidump_2019-09-11 142433_{...}.dmp"
"ERROR" 884 "2019-09-11 14:25:37.372" "Severity: 3 (Medium), Code: HM5136, Source: TCPConnection::AsyncReadCompleted, Description: An error occured while parsing data. Data length: 41, Data: A10 FETCH 77 (BODY.PEEK[]<31653.1048576>). Remote IP: 109...
"ERROR" 884 "2019-09-11 14:25:37.372" "Severity: 2 (High), Code: HM4208, Source: ExceptionHandler::Run, Description: An error occured while executing 'IOCPQueueWorkerTask'"

and they are always generated by 3-4 remote IPs. The IPs belong to two german ISPs, so I guess it's a problem caused by email clients, maybe Outlook? I blocked the IPs in Settings-Advanced-IP Ranges, but that didn't help.

I tried changing "Max number of command threads" from 30 to 40. The Data and Temp directories are excluded in the external virus scanner.

We're running Windows 2012R2, Hmail version 5.6.7-B2425 with 8000 mailboxes.

User avatar
mattg
Moderator
Moderator
Posts: 20231
Joined: 2007-06-14 05:12
Location: 'The Outback' Australia

Re: Errors HM5136 and HM4208

Post by mattg » 2019-09-11 23:56

Try and attach one of the minidumps to a post, or perhaps email to martin@hmailserver.com with a link to this thread

You could also block those IPs at your firewall, but it would be nice to know what is causing this

hMailserver ONLY keeps the last ten minidumps
Just 'cause I link to a page and say little else doesn't mean I am not being nice.
https://www.hmailserver.com/documentation

Grautvornix
New user
New user
Posts: 9
Joined: 2016-01-22 10:45

Re: Errors HM5136 and HM4208

Post by Grautvornix » 2019-09-17 10:16

I emailed the minidump to Martin last Thursday

palinka
Senior user
Senior user
Posts: 1209
Joined: 2017-09-12 17:57

Re: Errors HM5136 and HM4208

Post by palinka » 2019-09-17 11:11

Grautvornix wrote:
2019-09-11 15:23
It's always the same two messages
Have you tried simply deleting those 2 messages? Obviously, the user is unable to retrieve them, so what difference does it make?

I always thought this kind of error could be disk related. I could be way off base on that, but I would test your drive as well. The error has to do with peeking -> looking at the contents of the message -> opening the eml file to read. If its unable to read the file, it has to be a permission error (impossible in this context) or a disk error. That's my layman take on it anyway.

Grautvornix
New user
New user
Posts: 9
Joined: 2016-01-22 10:45

Re: Errors HM5136 and HM4208

Post by Grautvornix » 2019-09-26 11:12

I emailed the minidumps to Martin again yesterday. Would be nice to know what's in there, can someone else have a look?

And I meant that it's always the same two error messages, not email messages.

Tried to contact users that generate these errors to see if they have problems with certain messages and what clients they use. Did not succeed so far, one is tying to authenticate but is not enabled anymore, the other user didn't respond.

Grautvornix
New user
New user
Posts: 9
Joined: 2016-01-22 10:45

Re: Errors HM5136 and HM4208

Post by Grautvornix » 2019-10-07 14:08

Most of the errors were caused by a MailDroid client. The user told me that MailDroid was working until some weeks ago, then he got error messages and MailDroid stopped syncing the emails. That was the time when the errors on the Hmail server started.

Now we get the 5136/4208 errors about once in two or three days. To find out the corresponding user to the IP address I used to start IMAP logging, but this causes very large logfiles. Is there another way without logging IMAP for several days?

User avatar
mattg
Moderator
Moderator
Posts: 20231
Joined: 2007-06-14 05:12
Location: 'The Outback' Australia

Re: Errors HM5136 and HM4208

Post by mattg » 2019-10-08 01:42

There are some custom builds about that offer an event called 'OnClientConnect'

I use that and some custom logging to track who logs on from where.
How open to using ALPHA software are you? Not for the feint of heart and not recommended on a production machine.
Just 'cause I link to a page and say little else doesn't mean I am not being nice.
https://www.hmailserver.com/documentation

User avatar
Dravion
Senior user
Senior user
Posts: 1467
Joined: 2015-09-26 11:50
Location: Germany
Contact:

Re: Errors HM5136 and HM4208

Post by Dravion » 2019-10-08 08:26

@grautvornix
Please add the few Minidumps into a zip file and attach it to your next reply, i will take a look in to it

This is an IMAP Command execution Problem and has nothing to do with SMTP.
It occurs on a ASIO (BOOST-Framework) Async Thread Operation

parsing data. Data length: 40, Data: A8 FETCH 77 (BODY.PEEK[]<31653.1048576>). Remote IP: 109..."

In Detail, it is happening as your IMAP Client is fetching the size of a body of an specific Email Message (something in the Email itself, maybe an Attachement).
However: If the length cannot be estimated, the followup function which needs this information to reserve a proper buffer to store it's content cannot be created
correctly which causes a Memory access violation Problem and as result of it Windows forcefully terminates the hMailServer.exe Process.
The last thing Windows can do is, to run WERFAULT.EXE and and saving all Memory variables and CPU Register states into a Crash dump file for Post mortem
Error Diagnostics.

Actions:
Delete the Email files (*.eml file) in your DATA Folder which causes the trouble or make sure your Antivirus Software doesn't mess things up which fetching
Emails from hMailServer via IMAP.

Grautvornix
New user
New user
Posts: 9
Joined: 2016-01-22 10:45

Re: Errors HM5136 and HM4208

Post by Grautvornix » 2019-10-08 10:34

@mattg: it's a production server

@Dravion: thanks for checking the minidumps, some are attached.

To delete the eml files, I have to know which user out of 8000 is causing the problem. Because the errors happen just once every two days now, I have the problem to find out.
Attachments
Minidumps.zip
(265.13 KiB) Downloaded 15 times

User avatar
Dravion
Senior user
Senior user
Posts: 1467
Joined: 2015-09-26 11:50
Location: Germany
Contact:

Re: Errors HM5136 and HM4208

Post by Dravion » 2019-10-08 11:44

Crashdump reports:

ExceptionCode: c0000005 (Access violation)

I expected it already, so it's no surprise to me.

The Message "Access violation" is a Microsoft term, but the underlying Hardware Error, raised by the CPU is known as "General Protection fault".
The causing Software Application (in this case hMailServer.exe) simply was trying to access Memory blocks without permissions. This can happen by a lot
of different Situation, but in the mentioned context of hMailServer.exe's IMAP operation Error, this is simply a size Problem. The body peek
Function (which is a IMAP RFC Standard Command Sequence) doesn't return a proper size value to reserve, required by the Windows Kernel Memory Manager
to allocate the requested Memory. Without the correct size information, a wrong size will be returned which leads to an Access Violation and leads directly
to a NT-Kernel Process Termination (the App gets killed and forcefully removed from Memory).

I guess, if the User with its faulty Inbox is logs in next time, hMailServer will crash again, create new Crashdumps ect.

To prevent this:
1) Make sure your DATA Directory is not touched by any other process than hMailServer.exe. If hMailServer is blocked it cannot operate correctly.
2) Track down the problematic IMAP-Client and it's inbox by using netstat or a alternative Network sniffer tool (if you have the ip, you know which user credentials and its Mbox)

Post Reply