Solved

SMTP Service Terminates Unexpectedly - causes WWW, Exch Routing Engine to crash

Posted on 2004-09-10
8
543 Views
Last Modified: 2012-08-14
With no prior events in the event log and no recent changes to the server we have suddenly encountered an unreliable SMTP server. Event ID: 7034, 7031 Service Terminated Unexpectedly.
We have successfully restarted the services and the system will run well for some 5 or 6 hours then will quit again. Once it quits, it quits repeatedly for some length of time and then begins to work again. We have isolated the problem to the Exchange Server 2003 (running on Windows 2003 Server).
We had suspected some kind of DOS attack. The server is behind a PIX501 and Nessus scans are negative for vulnerabilities. sc query yields:  1067 (0x42b)

Any assistance gladly accepted. thx
0
Comment
Question by:ataylor1953
  • 2
  • 2
8 Comments
 
LVL 6

Accepted Solution

by:
chumplet earned 250 total points
Comment Utility
Ahhh... you may be experiencing a similar issue that we've recently run into.  We're also running Win2k3 with Exchange 2003, though we've seen most of our crashes in "inetinfo.exe" to start, then cascading to other services.  Yuck, yuck, yuck.  We are also running OWA (webmail) which is where it usually rears its ugly head first.  We also have dozens and dozens of those 7034 and 7031 Event IDs in our logs.

Anyhow, I've received a hotfix from Microsoft that I'm happy to give you a link to *BUT* please be aware that it may or may not fit your particular issue.  Tread lightly, I guess I'd say.  The hotfix is in reference to article Q827214, though it's not yet listed in their knowledge base.  You will need to reboot your Exchange Server after applying this hotfix (highly recommended to STOP all
Exchange services *before* the reboot).

You can grab the hotfix at...
http://67.105.130.90/temp/Exchange2003_Windows2003_Q827214_hotfix.zip

I hope that helps you out!

Chumplet
0
 
LVL 12

Assisted Solution

by:BNettles73
BNettles73 earned 250 total points
Comment Utility

Are you running SP1 ... Have you installed the IMF on it recently?

I'd turn up logging on MSExchangeTransport (SMTP) and MSExchangeMU (Metabase Update - IIS) to see if you can get a more clear picture of what is occurring. If you have metabase corruption it would cause SMTP to stop or hang.

Is your AV software scanning IIS or Exchange directories? This could also cause the issue.

Where is email actually queuing up? Have you checked the state of the queue in Queue Viewer on the E2K3 box?

Is this a mailbox server or do you use it primarily for mail transfer?

Do you run separate software to scan exchange and the OS?

I'd be very weary of installing any hotfixes until you are absolutely sure it is needed. I'd also make sure you get a solid backup of the server before making any modifications.

Brian
0
 
LVL 6

Expert Comment

by:chumplet
Comment Utility
Just an FYI.... we've not had a *single* process crash since installing this hotfix.  All appears to be back to normal.

Here's hoping... :)

Chumplet
0
 
LVL 12

Expert Comment

by:BNettles73
Comment Utility
Did you install Service Pack 1? The hotfix and a few transport related fixes was included in SP1 from what I understand ...
0
 

Author Comment

by:ataylor1953
Comment Utility
Thank you BNettles73 and chumplet for your inciteful feedback!

I did install SP1 on Exchange. All other OS security patches are also installed.

Here is the good news, I solved the problem of the Exchange services shutting down. What follows is a long winded recounting of my misadventures.

Having read your responses and having looked again at the server, I decided to start my troubleshooting from the beginning.
Ultimately, I solved the problem with the aid of my teenage kids, who know nothing about computers. If you want to find out what the kids did last night, ask the question in several ways. Subtle differences in their answers will lead you to the truth.

 I had my servicing technician on the phone, and asked him about ANY changes made to the server recently. Not much feedback. This guy is no kid and has lots of experience. "Well did you fix anything on the server during your last visit?" Not much feedback, just maintenance stuff. "Did you apply any patches on your last visit?" Nope, was the answer.
 Finally, I asked the right question, "Did you do anything to the server, or anything physically attached to the server?" Yes, he did. He worked on the APC UPS. Oh, and yes he did remember that he installed a Java "upgrade" to get the APC UPS software to work. In the imortal words of Homer Simpson, "D'uh Oh!" Since the uninstallation of this Java "upgrade"  we have had no shutdowns. I felt like a nitwit. But alas, it is sometimes not the "IF you asked the question" that gets you there. It is the "HOW you asked the question" that makes communication work.

Again, many thanks.

-ataylor53
0

Featured Post

Want to promote your upcoming event?

Are you going to an event? Are you going to be exhibiting at a tradeshow? Talking at a conference? Using a promotional banner in your email signature ensures that your organization’s most important contacts stay in the know and can potentially spread the word about the event.

Join & Write a Comment

Easy CSR creation in Exchange 2007,2010 and 2013
This process describes the steps required to Import and Export data from and to .pst files using Exchange 2010. We can use these steps to export data from a user to a .pst file, import data back to the same or a different user, or even import data t…
In this video we show how to create a User Mailbox in Exchange 2013. We show this process by using the Exchange Admin Center. Log into Exchange Admin Center.: First we need to log into the Exchange Admin Center. Navigate to the Recipients >> Mailb…
In this video we show how to create a Shared Mailbox in Exchange 2013. We show this process by using the Exchange Admin Center. Log into Exchange Admin Center.: First we need to log into the Exchange Admin Center. Navigate to the Recipients >> Sha…

762 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

15 Experts available now in Live!

Get 1:1 Help Now