Troubleshooting Abuse Reports#
Almost every question about the sync — did it run, did it see my email, why did it not create a report — is answered by the log. Start there.
Reading the sync log#
Open Logs in the admin panel and search for Abuse email sync. Each run writes a “started” and a “completed” entry; the completed entry carries the number of emails seen, processed, and failed. Between them, one or more entries describe each email. Click an entry to see its details (sender, subject, extracted IPs, and so on).
Routine entries are kept for 24 hours and then cleaned up automatically; “report created” and error entries are kept permanently.
| Log entry | Meaning | Kept |
|---|---|---|
| Abuse email sync skipped: IMAP settings are not configured | IMAP Host, User, or Password is empty. The details list which. | 24 hours |
| Abuse email sync started | A run began. | 24 hours |
| Abuse email sync: could not connect to mailbox | Login to the IMAP server failed. | 24 hours |
| Abuse email sync completed | A run finished. Details: total emails, processed, errors. | 24 hours |
| Abuse email sync: skipped email from ignored sender | The email was sent from the IMAP User address and was archived without a report. | 24 hours |
| Abuse email sync: no IPs found in email | Nothing in the attachments, subject, or body looked like an IP address (and domain resolution is off or found nothing). No report was created. | 24 hours |
| Abuse email sync: extracted IPs from attachment | IPs were read from a XARF JSON or XML attachment. Details list them. | 24 hours |
| Abuse email sync: extracted IPs from email body | IPs were scraped from the subject or body. Details list them. | 24 hours |
| Abuse email sync: resolved domain to server IP | Domain resolution matched a hostname to one of your IPs. Details show the hostname, every address it resolved to, and the one used. | 24 hours |
| Abuse email sync: domain resolved to no IP address in SynergyCP | Domain resolution ran but no hostname resolved to an address in your deployment. Details list every hostname and address tried. | 24 hours |
| Abuse email sync: failed to read attachments | The attachments could not be decoded; the subject and body were still searched. | 24 hours |
| Abuse email sync: failed to parse XARF JSON attachment | A .json attachment was not valid JSON. |
24 hours |
| Abuse email sync: failed to parse XML attachment | A .xml attachment could not be read. |
24 hours |
| Abuse email sync: report created | A report was created. One per IP per email; details give the IP, sender, and subject. | Permanently |
| Abuse error while saving report | An unexpected error while creating the report or archiving the email. The exception is attached. | Permanently |
No reports are being created#
Work down this list:
- Is the sync running at all? Look for “Abuse email sync started” entries at the configured frequency. If there are none, the SynergyCP scheduler is not running — this affects every scheduled task, not just this package. Check the panel’s cron/scheduler service.
- “IMAP settings are not configured” — fill in all three of IMAP Host, IMAP User, and IMAP Password under System > Settings > Abuse Reports.
- “could not connect to mailbox” — the host, user, or password is wrong, IMAP is disabled on the account, or the SynergyCP server cannot reach the mail server on port 993. For Google accounts, use an App Password, not the account password. Test the credentials from the SynergyCP server with another IMAP client if in doubt.
- “completed” shows zero emails — the inbox is empty. Confirm your abuse address actually delivers to this mailbox and that mail is not being filtered into another folder; only the inbox is read.
- “no IPs found in email” — the email names the target by hostname or not at all. If it names a hostname, enable Resolve domain names to IP addresses (see Domain resolution). Reports cannot be created by hand, so an email with no usable address has to be handled outside the panel.
- Reports are created but you cannot see them — check that your admin group has the Abuse Reports > Read Reports permission. Without it the menu entry is hidden entirely.
The same email is processed on every sync#
The message could not be moved to the archive folder, so it is still in the inbox each time. The log shows an “Abuse error while saving report” entry per sync for it, usually mentioning the mailbox name. Create the folder on the mail server with exactly the name in Archive Folder (or the auto-detected default — [Gmail]/All Mail for Google, Archived for others), or set Archive Folder to a folder that exists. Servers that nest folders under the inbox may need INBOX.Archived.
No duplicate reports are created while this is happening.
The report went to Unknown instead of the client#
The reported IP is not inside any IP entity assigned to a server with a client. Check:
- The IP entity exists under Network > IPs and covers the address.
- The entity is assigned to a server, and that server is assigned to a client.
- The email did not also mention one of your addresses elsewhere — when at least one address in an email belongs to you, only those addresses are reported, so the right report may exist under a different IP.
Assign the report by hand with the pencil icon on the report page; the client is notified at that point.
The client did not receive the notification email#
- Send abuse emails must be ticked in System > Settings > Abuse Reports.
- The client may have unticked Receive Abuse report notifications via email on their Abuse Reports page, or set a different abuse contact address there. Admins cannot see this setting; ask the client.
- Email sending must be working in general — see Email Sending.
- The report must have a client when the email is triggered. Reports in Unknown send nothing until they are assigned.
A server was suspended unexpectedly#
Auto suspension suspended it because a report had been Waiting on CLIENT for longer than the Auto Suspension period. The server’s log has the suspension entry, and the report’s log shows when it entered Waiting on CLIENT — note that an admin comment restarts the countdown. Reactivate the server with Activate on its page; see Automatic suspension for the rules and exemptions. To stop auto suspension entirely, clear the Auto Suspension setting.
Clients get a suspension warning every day#
This is by design: the warning is sent daily until the client replies to the report or the deadline passes. Replying moves the report to Waiting on ADMIN, which stops the warnings.
The panel UI looks wrong after upgrading the package#
If pages look broken right after a package upgrade (missing buttons, or labels showing as pkg.abuse... key paths), the browser is holding cached assets. Do a hard refresh (Ctrl+Shift+R / Cmd+Shift+R); if something still looks off, clear the browser cache for both the panel and API domains.
Still stuck?#
Contact support with the subject and sender of the email in question and the “Abuse email sync” log entries from the run that should have processed it.