Error Message

The error in the Veritas Enterprise Vault event logs: 

Log Name:      Veritas Enterprise Vault
Source:        Enterprise Vault 
Date:          8/16/2023 2:50:44 PM
Event ID:      45824
Task Category: SMTP Service
Level:         Error
Keywords:      Classic
User:          N/A
Computer:      evarch1.ev.local
Description:
The Enterprise Vault SMTP service reported the following event: 
F-MTA_SMTP-ListenError Error on listener; IOevent-IOerror Error occurred on connection in bind; System-WSAEADDRINUSE Only one usage of each socket address (protocol/network address/port) is normally permitted.
Internal details: [identity: 101 severity: 13 level: 13 facility: 102 id: -798621595]

A dtrace of the isode.pdd.smtp process shows the following:

(isode.pp.smtp)    <8556>    EV~I    Event ID: 45828 The SMTP Service has started.
(isode.pp.smtp)    <8556>    EV:M    {CSmtpLogger::LogAuditMessage:#146} Audit Event type:Service Details: name:EnterpriseVaultSMTPService state:started version:isode 17.1v1-0 [858c4b5e87] () of Wed, Dec 09, 2020  5:49:18 PM
(isode.pp.smtp)    <8556>    EV:L    {EVEventLogCallback:#47} SMTP service counters has been initialized.
(isode.pp.smtp)    <8556>    EV:L    {CSmtpLogger::LogMessage:#123} D-X509-trace_func Called x509_init_security|Internal details: [identity: 131 severity: 4 level: 4 facility: 30 id: 1075708035]
(isode.pp.smtp)    <8556>    EV:L    {CSmtpLogger::LogMessage:#123} D-X509-init_security Initialising X.509 security environment: ID no directory|Internal details: [identity: 62 severity: 4 level: 4 facility: 30 id: 1075707966]
(isode.pp.smtp)    <8556>    EV:L    {CSmtpLogger::LogMessage:#123} X-RFC4158-using_library Using rfc4158 library (as requested)|Internal details: [identity: 7 severity: 1 level: 1 facility: 34 id: 270663687]
(isode.pp.smtp)    <8556>    EV:L    {CSmtpLogger::LogMessage:#123} X-RFC4158-path_create Path created for subject CN=evsmtp1.ev.local,OU=lab,O=veritas,L=heathrow,ST=usa,C=US with 0 trust anchors lookup mode unspecified|Internal details: [identity: 1 severity: 1 level: 1 facility: 34 id: 270663681]
(isode.pp.smtp)    <8556>    EV:M    {CSmtpLogger::LogMessage:#123} N-MTA_SMTP-TLS TLS: initialized|Internal details: [identity: 251 severity: 6 level: 6 facility: 102 id: 1617297659]
(isode.pp.smtp)    <8556>    EV:M    {CSmtpLogger::LogMessage:#123} N-MTA_SMTP-Listen Listening on [::]:25 for channel key smtp|Internal details: [identity: 100 severity: 6 level: 6 facility: 102 id: 1617297508]
(isode.pp.smtp)    <8556>    EV:M    {CSmtpLogger::LogMessage:#123} N-MTA_SMTP-Listen Listening on 0.0.0.0:25 for channel key smtp|Internal details: [identity: 100 severity: 6 level: 6 facility: 102 id: 1617297508]
(isode.pp.smtp)    <8556>    EV~E    Event ID: 45824 The Enterprise Vault SMTP service reported the following event: |F-MTA_SMTP-ListenError Error on listener; IOevent-IOerror Error occurred on connection in bind; System-WSAEADDRINUSE Only one usage of each socket address (protocol/network address/port) is normally permitted.|Internal details: [identity: 101 severity: 13 level: 13 facility: 102 id: -798621595]|For information about Enterprise Vault SMTP Archiving and troubleshooting advice, see the following article on the Veritas Support website: http://www.veritas.com/docs/DOC7121
(isode.pp.smtp)    <8556>    EV:H    {CSmtpLogger::LogMessage:#123} F-MTA_SMTP-Terminating SMTP server terminating on fatal error|Internal details: [identity: 117 severity: 13 level: 13 facility: 102 id: -798621579]
(isode.pp.smtp)    <8556>    EV~I    Event ID: 45829 The SMTP Service has stopped.

Just before the Event ID 45824 in the dtrace there is a line stating that another process is listening on port 25:

N-MTA_SMTP-Listen Listening on [::]:25

This is why the error in the event has a System-WSAEADDRINUSE reference because port 25 (which is used by the EV SMTP service) is already in use by another process.  

There are multiple ways to resolve this issue:

1. Change the port being used by the Enterprise Vault SMTP Server 

Note: The default port (25) can be changed in the Enterprise Vault Console - SMTP Properties section.

2. Find which process is using port currently 25.  Run the following netstat command to get a list of ports: 

netstat -ano -p tcp

The top results should show port 25 (e.g., 0.0.0.0:25).  If the State is LISTENING then this demonstrates the issue.  There is some other process using port 25 which is needed for the EV SMTP process to run.   

To find the offending process, some investigation is needed.  Follow the steps below: 

1. Open Windows Task Manager on the EV server.
2. Go to the Details tab. 
3. Sort by the PID column and look for 15212 as identified in the netstat.  
   
4. To get further details, we can go to the Services tab, which shows it's the SMTPSVC (Windows SMTP Server feature) that's using port 25 and preventing the EV SMTP service from starting.