Exchanger Server 2003 .stm file too large!

My guess is that your server is probably being used as a SPAM relay or your anti-virus application is scanning your message store.

This helps to demystify the .stm file.
From question:
https://www.experts-exchange.com/questions/21223835/Priv-stm.html

Assisted Answer from flyguybob
Date: 11/29/2004 05:34PM EST
Grade: A
 Assisted Answer  


The .STM file, or streaming file, holds non-MAPI information while the .edb file, or the Exchange database (essentially a large JET (Access) database holds the messages and the MAPI information.  If someone sends e-mail or accesses e-mail from a non-MAPI client (POP3, IMAP4, Web), that e-mail is stored in the .stm file.  Mail from the internet is also non-MAPI and comes in a format called MIME. This information is also stored in the STM file.

It may be converted to MAPI when a MAPI user (Outlook) accesses it and it is also converted to MAPI when the Move Mailbox wizard is used.  There also may be pointers in the .edb to information in the STM.


Accepted Answer from flyguybob
Date: 11/29/2004 05:38PM EST
Grade: A
 Accepted Answer  


Here are a few links that help to demystify the STM file:

http://www.winnetmag.com/Windows/Article/ArticleID/8955/8955.html
  (about 1/3 of the way down in the document the STM is discussed)

Native Content Storage in Microsoft Exchange
http://support.microsoft.com/default.aspx?scid=kb;en-us;232323
  (Good article...communicates the idea behind the STM very well)

If you need any more links or information, please reply.

Another thing that you could have in your system is a loop.  Leaving Exchange up (and getting an outage approved), unplug the network cable temporarily.  Take a look at your queues and see what gets queued up.  Look @ both the SMTP messages and the messages in your MTA.  Another thing to do is to enable message tracking.

Look at your mailboxes and see what the largest mailbox is.  

If you have a 111GB STM and a 3GB EDB, something is wrong.  Even a slew of POP3 users won't do that to an Exchange server.

Please see this question regarding file-level AV scanners and Exchange:
https://www.experts-exchange.com/questions/21300420/Symantec-Anti-Virus-on-Exchange-Considerations-on-installing-Symantec-or-Norton-AntiVirus-Corporate-Edition-on-mail-servers.html

How would a check to see if someone was using my serve as a spam relay?

Sembee, our resident MVP and Exchange Expert, has a good page that details this:
http://www.amset.info/exchange/spam-cleanup.asp

Thank you, I'm not a relay.  

When you say Anti-Virus are you refering to the Client or the Server.  I'm running a stand alone Symantec Anti-Virus Client on my Exchange server and It's also running Symantec Anti-Virus for Exchange.  Which one could be the colpruit?

Your STM file is used to cache data before putting it into the EDB file.  It sounds like the stm file is either corrupt or exchange is being attacked.  You need to do some message tracking and  verify mailflow and user logons.  To test for a corrupt STM I would shut the services down, and remove the stm file, and then restart the services.  This will eradicate any mail that was being held in the stm, and start all over.   See if the STM file rebuilds to the same size.

Umm...I would HIGHLY recommend against whacking the STM file.
One thing, provided you have the space AND a valid backup, would be an offline defrag.

The culprit would be the SAV Client (see my post, also listed above).

Comment from flyguybob
Date: 05/02/2005 01:52PM EDT
 Your Comment  


Please see this question regarding file-level AV scanners and Exchange:
https://www.experts-exchange.com/questions/21300420/Symantec-Anti-Virus-on-Exchange-Considerations-on-installing-Symantec-or-Norton-AntiVirus-Corporate-Edition-on-mail-servers.html 

Wouldn't removing the .stm file kill a lot of email?  

What puzzles me the most is that I don't have any POP3 clients.  They are all OWA.

Yes, it would cause a problem.

One thing that you can do is look at the mailbox sizes, add them all up, and see if they are over 115GB.  If they are, then you are fine.  What shows in a mailbox includes the single instance storage info.  So, if 2 mailboxes have a 1GB attachment (unrealistic, I know), they will total 2GB but the database will be 1GB (and change) (this is provided a new server with only 2 mailboxes).

OWA users...that could explain it as well.

They are roughtly the size of my .edb file say 3.5 GB.

After uninstalling and reinstalling my Anit-Virus for exchange, the .stm file has stopped growing. I don't believe it will shrink any time soon but atleast it's not getting any bigger.

Thanks.

The file will not shrink until it has been defragmented offline.

This may help, if you are using NAV/SAV for Exchange.
http://bobchristian.blogspot.com/2005/02/symantec-mail-security-settings.html