Email received but cannot load ticket

Hey, I’ve inherited several RT setups, and one of them occasionally has issues where the members of a queue receive an email to tell them the ticket has been generated and the email contains the content, but if they try and open the ticket or search for the ticket in RT it says cannot load ticket, does anyone know the best way to diagnose this? which logs I would look at? from the half a dozen or so times it’s happened in the last few months it seems to be only when there’s attachments, they don’t appear to be too large or anything and what’s interesting to me is that the end user in order to get my attention to look in to this issue has forwarded the email RT generated to the RT system my team uses(different instance/server) and it came through fine in our RT (same version).

RT version 5.0.1

I grep’d for the ticket number in the /var/log/rt.log and I can see this

Message-ID: rt-5.0.1-9101-1695602524-958.2093-18-0@DOMAIN (/opt/rt5/sbin/…/lib/RT/Action/SendEmail.pm:708)
[9101] [Mon Sep 25 00:42:43 2023] [info]: rt-5.0.1-9101-1695602524-958.2093-18-0@DOMAIN #2093/36592 - Scrip 18 Send Greeting (/opt/rt5/sbin/…/lib/RT/Action/SendEmail.pm:285)
[15937] [Mon Sep 25 01:56:01 2023] [debug]: Found a ticket ID. It’s 2093 (/opt/rt5/sbin/…/lib/RT/Interface/Email.pm:648)
[15937] [Mon Sep 25 01:56:01 2023] [debug]: RT::Ticket=HASH(0x560789e76420) tried to load a bogus ticket: 2093 (/opt/rt5/sbin/…/lib/RT/Ticket.pm:150)
[15937] [Mon Sep 25 01:56:01 2023] [crit]: Message not recorded: FW: SUBJECT: Could not find a ticket with id 2093 (/opt/rt5/sbin/…/lib/RT/Interface/Email.pm:708)
[15937] [Mon Sep 25 02:13:45 2023] [debug]: RT::Ticket=HASH(0x56078a37efa0) tried to load a bogus ticket: 2093 (/opt/rt5/sbin/…/lib/RT/Ticket.pm:150)
[15937] [Mon Sep 25 02:13:45 2023] [error]: Could not load ticket 2093 (/opt/rt5/share/html/Elements/Error:78)
[15937] [Mon Sep 25 02:13:45 2023] [debug]: RT::Ticket=HASH(0x560789a04438) tried to load a bogus ticket: 2093 (/opt/rt5/sbin/…/lib/RT/Ticket.pm:150)
[41934] [Mon Sep 25 19:23:49 2023] [debug]: RT::Ticket=HASH(0x562d82c493a0) tried to load a bogus ticket: 2093 (/opt/rt5/sbin/…/lib/RT/Ticket.pm:150)
[41934] [Mon Sep 25 19:23:49 2023] [error]: Could not load ticket 2093 (/opt/rt5/share/html/Elements/Error:78)
[41934] [Mon Sep 25 19:23:49 2023] [debug]: RT::Ticket=HASH(0x562d83609178) tried to load a bogus ticket: 2093 (/opt/rt5/sbin/…/lib/RT/Ticket.pm:150)

DOMAIN & SUBJECT have been substituted by me to maintain anonymity.

I’ve done some side-by-side comparisons with the affected RT system vs 3 other unaffected instances and I can’t see anything obvious.
Does anyone here have any ideas?

I can not really follow your description.

The log seems to me like you try to inject an email with a ticket-ID in the subject. RT tries to append the mail to an existing ticket whitch does not exist. Anyway it is strange RT sends out the message without creating the ticket. In my opinion this cannot be triggered by the action “OnCreate”. So it has to be another trigger. Maybe this is a point to continue research.

Regards Andre.