Exchange resend hundreds of messages

All,

I am looking for where these messages might be queued.  I have tried the usual suspects.  I am seeing in message tracking that the full email address is being used for these replayed messages yet for true sent messages jsut the alias is used.  Also the message does not come from the store driver, yet the AQ processes the message any way.  I found some logs regarding the inetsvcxxx.log files that corresponded to these dates and just now deleted them but I am unaware of how these would show up in the message tracking center and sent yet again.  Any ideas???

srphil01Asked:
Who is Participating?
 
Ehab SalemConnect With a Mentor IT ManagerCommented:
If you have Symantec Antivirus and symantec mail security on the server, the following precautions have to be taken:
1- Do not let symantec AV scan the temp folder of symantec mail security
2- Do not let SAV scan all exchange folders, mail, queue, ...

There are 2 articles in symantec describing all that.

This problem might also happen from a bad raid controller. Check the system events for hd write errors.
0
 
airnikeCommented:
try turning the relay off ...
0
 
SembeeCommented:
Antivirus is the usual suspect in cases like this. It is the first place I would look.
An anti spam product operates in a similar way.

The messages may not be queued on your server. If your email comes in via another server they could be queued there.

Simon.
0
Has Powershell sent you back into the Stone Age?

If managing Active Directory using Windows Powershell® is making you feel like you stepped back in time, you are not alone.  For nearly 20 years, AD admins around the world have used one tool for day-to-day AD management: Hyena. Discover why.

 
Ehab SalemIT ManagerCommented:
Are you using Microsoft IMF for antispam? If you use it along with other software (like IMF companion) the mail delivered to the archive folder if you release it it will be resent to all recipients again and you will see in the log that the sender is the original recipient.

I am facing that same problem now and still can't figure out how to avoid that.
0
 
airnikeCommented:
try logging in to the OWA and delete the mails from there ... i got this previously ...
0
 
srphil01Author Commented:
Perhaps more info is needed.  This is a single Exchange Server.  Symantec Mail protection.  I have checked under locations that have Mail queuing aspects.  Such as c:\program files\exchsrvr\mailroot\vsi 1\folders as well as the IIS logs.  I recently removed some older inetsrv.logs and will be rebuilding the server this weekend.  

What has been happening is that the Disk array craps out and exchange dismounts.  I believe that the logs are corrupt as they are unable to commit to disk.  I will keep everyone posted and thanks for the info.

in understanding the problem, the users store never sends the replayed message.  The Advanced Queuing is receiving this from ????????.  

Is it possible that the IIS has these messages and upon restart of Exchange would redirect them back to the Exchange environment for redirection?
0
 
SembeeCommented:
If Exchange was sitting on the messages then they would show in the queues.
If the queues were clear, then the next place I would look is any anti virus applications. Symantec products would cause me to look at there first.

Simon.
0
 
srphil01Author Commented:
Ehabsalem:

I think you are on.  I have been seeing Write failures which leads to the store dismounting, however the serviecs remain in a started state.  Any time that I see this write failure we tend to add to the messages that are sent and typically from this date that the stores dismount.

With the RAID controller being the case, any ideas for fix.

Thanks
0
 
Ehab SalemIT ManagerCommented:
In my case I had to change the RAID controller.
0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.