False modification alerts sent from SharePoint sites RRS feed

  • Question

  • Hello everyone,

    Wondering whether anyone would be able to guide me finding the cause of an incident we experience recently.

    Recently some of our users received thousands of emails (in a span of few hours) from SharePoint sites indicating items were modified / edited by “System Account”.  Though when checked the SharePoint items history it does not reflect that – meaning item in SharePoint still shows the original creator and modifier. Nothing was actually changed on the SharePoint sites as far as we can tell.

    So far we only know of this happening to one web application – though the same farm hosting other web applications were unaffected. This happened once before (around 6 months ago) with the same web application affecting only a particular list. But this time it seems to be more sites and lists are affected. As a result (or coincidentally) running workflows were cancelled from that web app.

    I can’t seem to find anything from the log files (Windows event and ULS logs) indicating what actually triggered this.

    I came across similar issue in this forum but that seems like was fixed with SP2 and we have our farm patch level (August 10 CU) currently. Has anyone experienced this? Any suggestion would be greatly appreciated.

    Note: The affected MOSS 2007 farm has 2 WFEs and 1 Application server all Windows 2003 servers on VMWare. Backend is a physical SQL server 2008 R2.

    Many thanks in advanced!

    Item from the alert:

    Same item from the SharePoint list:


    • Edited by BlueSky2010 Tuesday, August 23, 2011 1:39 PM inserted image
    Tuesday, August 23, 2011 12:58 PM

All replies

  • Do you have content expiration set by any means?
    Thanks & Regards, Soumyadev | Posting is provided "AS IS" with no warranties, and confers no rights.
    Tuesday, August 23, 2011 11:39 PM
  • Hi,

    This shows that something is going on there.

    Do you have any timer job or workflow enabled?

    Have you checked the ULS log of that time to find exactly what was going on that time?

    Thanks, Rahul Rashu
    Wednesday, August 24, 2011 4:14 AM
  • @Soumyadev - no content expiration is set.

    @Rahul - most of the lists has OOB parallel content approval workflow enabled. But as you can see on the 2nd screen shot nothing was changed on SharePoint. I see much more activities during that time in ULS logs but nothing is conclusive to me what triggered all those FALSE emails and cancelled the running workflows.

    Thank you for your suggestions.

    Any other ideas anyone?  



    Wednesday, August 24, 2011 12:55 PM
  • Hi,

    Whether this is happening at any specific time? If yes I suggest you to turn on verbose mode of logging at that time so that this activity can be tracked.

    I hope this will help you out.

    Thanks, Rahul Rashu
    Wednesday, August 24, 2011 1:33 PM
  • This is the 2nd time it happened in 6 months time and time was not the same. It gonna be really hard on disk to turn on verbose on all items for unlimited amount of time. Any suggestion what category you'll turn on for verbose logging?
    Wednesday, August 24, 2011 4:17 PM