SMTP Service Terminates Unexpectedly - causes WWW, Exch Routing Engine to crash

With no prior events in the event log and no recent changes to the server we have suddenly encountered an unreliable SMTP server. Event ID: 7034, 7031 Service Terminated Unexpectedly.
We have successfully restarted the services and the system will run well for some 5 or 6 hours then will quit again. Once it quits, it quits repeatedly for some length of time and then begins to work again. We have isolated the problem to the Exchange Server 2003 (running on Windows 2003 Server).
We had suspected some kind of DOS attack. The server is behind a PIX501 and Nessus scans are negative for vulnerabilities. sc query yields:  1067 (0x42b)

Any assistance gladly accepted. thx
Who is Participating?

Improve company productivity with a Business Account.Sign Up

chumpletConnect With a Mentor Commented:
Ahhh... you may be experiencing a similar issue that we've recently run into.  We're also running Win2k3 with Exchange 2003, though we've seen most of our crashes in "inetinfo.exe" to start, then cascading to other services.  Yuck, yuck, yuck.  We are also running OWA (webmail) which is where it usually rears its ugly head first.  We also have dozens and dozens of those 7034 and 7031 Event IDs in our logs.

Anyhow, I've received a hotfix from Microsoft that I'm happy to give you a link to *BUT* please be aware that it may or may not fit your particular issue.  Tread lightly, I guess I'd say.  The hotfix is in reference to article Q827214, though it's not yet listed in their knowledge base.  You will need to reboot your Exchange Server after applying this hotfix (highly recommended to STOP all
Exchange services *before* the reboot).

You can grab the hotfix at...

I hope that helps you out!

BNettles73Connect With a Mentor Commented:

Are you running SP1 ... Have you installed the IMF on it recently?

I'd turn up logging on MSExchangeTransport (SMTP) and MSExchangeMU (Metabase Update - IIS) to see if you can get a more clear picture of what is occurring. If you have metabase corruption it would cause SMTP to stop or hang.

Is your AV software scanning IIS or Exchange directories? This could also cause the issue.

Where is email actually queuing up? Have you checked the state of the queue in Queue Viewer on the E2K3 box?

Is this a mailbox server or do you use it primarily for mail transfer?

Do you run separate software to scan exchange and the OS?

I'd be very weary of installing any hotfixes until you are absolutely sure it is needed. I'd also make sure you get a solid backup of the server before making any modifications.

Just an FYI.... we've not had a *single* process crash since installing this hotfix.  All appears to be back to normal.

Here's hoping... :)

Did you install Service Pack 1? The hotfix and a few transport related fixes was included in SP1 from what I understand ...
ataylor1953Author Commented:
Thank you BNettles73 and chumplet for your inciteful feedback!

I did install SP1 on Exchange. All other OS security patches are also installed.

Here is the good news, I solved the problem of the Exchange services shutting down. What follows is a long winded recounting of my misadventures.

Having read your responses and having looked again at the server, I decided to start my troubleshooting from the beginning.
Ultimately, I solved the problem with the aid of my teenage kids, who know nothing about computers. If you want to find out what the kids did last night, ask the question in several ways. Subtle differences in their answers will lead you to the truth.

 I had my servicing technician on the phone, and asked him about ANY changes made to the server recently. Not much feedback. This guy is no kid and has lots of experience. "Well did you fix anything on the server during your last visit?" Not much feedback, just maintenance stuff. "Did you apply any patches on your last visit?" Nope, was the answer.
 Finally, I asked the right question, "Did you do anything to the server, or anything physically attached to the server?" Yes, he did. He worked on the APC UPS. Oh, and yes he did remember that he installed a Java "upgrade" to get the APC UPS software to work. In the imortal words of Homer Simpson, "D'uh Oh!" Since the uninstallation of this Java "upgrade"  we have had no shutdowns. I felt like a nitwit. But alas, it is sometimes not the "IF you asked the question" that gets you there. It is the "HOW you asked the question" that makes communication work.

Again, many thanks.

Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.