?
Solved

Store.exe CPU Utilization at 100% on Exchange 2003

Posted on 2009-04-03
14
Medium Priority
?
1,665 Views
Last Modified: 2012-05-06
We have an Exchange server for our company email; and just this week we've been having problems with the store.exe process running at 100% cpu utilization.  It's been a very stable system for many years, but it just started up this week and I'm at a loss for what could be causing the problem.  While the store is running at 100%, employees are unable to access email through Outlook or OWA.  Every now and then a few messages might sneak through, but they are usually delayed between 15 minutes and 2 hours.

I could use some assistance trouble-shooting the problem.
0
Comment
Question by:ellisgolf
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 4
  • 4
  • 3
  • +2
14 Comments
 
LVL 65

Assisted Solution

by:Mestha
Mestha earned 80 total points
ID: 24065425
What else is on the system? Store.exe usually points to one thing - AV software. It is always the first place I look. Ensure that any file level AV isn't scanning the store. If you have Exchange integrated AV then that could also cause the problem, particularly if it is Symantec's.

Simon.
0
 
LVL 9

Assisted Solution

by:cmorffew
cmorffew earned 80 total points
ID: 24065505
Had this problem too it was something to do with the /3GB switch for your boot.ini and memory allocation.  Looking for the article now....
0
 
LVL 9

Expert Comment

by:cmorffew
ID: 24065525
Here it is..
http://support.microsoft.com/kb/823440

I have used both switch's/USERVA=3030 and the /3GB and haven't had an issue again.
0
Office 365 Training for IT Pros

Learn how to provision tenants, synchronize on-premise Active Directory, implement Single Sign-On, customize Office deployment, and protect your organization with eDiscovery and DLP policies.  Only from Platform Scholar.

 

Author Comment

by:ellisgolf
ID: 24065675
We do have Symantec Mail Security for Microsoft Exchange ---- it's been there for years and years, though, without any issues.  If that is the suspected problem, what can I do to test out that theory?  Our regular Systems Administrator is out for the weekend and I'm the lucky person who gets to fill in --- no experience with Symantec Mail Security or deep experience with Exchange; but capability and willingness to learn and learn quickly.
0
 

Author Comment

by:ellisgolf
ID: 24065692
....i.e, how do I safely stop the Symantec Mail Security engine and eventually restart?
0
 
LVL 9

Expert Comment

by:cmorffew
ID: 24067635
does your boot.ini already have the switches?

Why would you want to stop the security engine?  All you need to do is add an exception so that it does not scan the store.exe file.
0
 

Author Comment

by:ellisgolf
ID: 24069442
From what I understand, the Mail Security Engine only scans messages.  It isn't a file-scanner type of anti-virus.  I'll take a look at the boot.ini and report back...
0
 
LVL 65

Expert Comment

by:Mestha
ID: 24069450
Here is your problem: "Symantec Mail Security for Microsoft Exchange"
I operate a simply policy with Symantec products. Anything odd going on with the server with Symantec installed, the problem is the Symantec product unless shown otherwise by its complete removal. In most cases removing it does in fact resolve the issue.

Disabling it is not enough, as the hooks remain in the system, it needs to be removed and rebooted.

If you go back through my posts both under this ID and Sembee, you will find I have been fairly consistent on this and fairly consistent on the cause of the issue being Symantec.

Oh and the fact that product has worked for years before without any issues does not mean it will continue to do so. AV is a living software product which updates frequently - problems with it are well known and will happen to all of them.

Simon.
0
 
LVL 42

Assisted Solution

by:paulsolov
paulsolov earned 80 total points
ID: 24069676
I disagree with Mestha, with SMSE you should be able to turn off both of the Symantec Mail Security Services and do a test.  Make sure there are no services stuck in "stopping" or "starting" mode as well.  If you're running local anti-virus on the system make sure you are excluding the exchange information store directories as well as exchange root folder, this may cause an issue as well.
0
 
LVL 65

Expert Comment

by:Mestha
ID: 24069734
paulsolov - you don't know enough about the way that Exchange based av products hook in to Exchange. With the services disabled they can still affect things because the hooks are still there. The only way to show it isn't the product is to remove it. This is unique to the way that Exchange and AV products hook together. You can disable Windows AV and not see any problems, but Exchange AV is handled in a different way.

Simon.
0
 
LVL 42

Expert Comment

by:paulsolov
ID: 24069839
I have installed a several hundred of these installs over the years and SMSE may cause issues but can usually be disabled via services.msc to test.  Local AV is different and needs to be modified so that EDB, STM, LOG files are not scanned which may cause issues.  

There were a few issues with Symantec Mail Security for Exchange with the older versions but the newer ones are a bit more stable.  With SMSE you can uninstall and re-install without a reboot btw.
0
 
LVL 65

Expert Comment

by:Mestha
ID: 24071897
The only way to ensure that its hooks are removed is to reboot the server. There is nothing that Symantec can do about that, it is just the nature of the way the hooks in to Exchange work. Symantec may not prompt you for a reboot, but it will be required. The reboot is only required if something cannot be removed that would affect the system's stability.

Simon.
0
 
LVL 10

Assisted Solution

by:kevala
kevala earned 80 total points
ID: 24072178
If you'd like to take Symantec out of the picture ("mostly") without uninstalling, you can:

1. Set all Symantec services to disabled
2. Open regedit, navigate to HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\MSExchangeIS\VirusScan
3. Set the Enabled value to 0
4. Reboot the server

These combinations will help prevent the antivirus DLLs from loading into memory, and the reg key removes the AV hook into the store/ESE.

I find in most of the cases i work, if Symantec is causing the issue, this is enough to prove it.
HOWEVER, in some (fewer) cases, a complete removal is required.
0
 

Accepted Solution

by:
ellisgolf earned 0 total points
ID: 24205304
Ok ---- so an update.  It is not related to the anti-virus, but it was related to a service that had been connecting to Exchange via POP3.  Everything appears to be back to normal for the time being.
0

Featured Post

Problems using Powershell and Active Directory?

Managing Active Directory does not always have to be complicated.  If you are spending more time trying instead of doing, then it's time to look at something else. For nearly 20 years, AD admins around the world have used one tool for day-to-day AD management: Hyena. Discover why

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

This article will help to fix the below error for MS Exchange server 2010 I. Out Of office not working II. Certificate error "name on the security certificate is invalid or does not match the name of the site" III. Make Internal URLs and External…
If you troubleshoot Outlook for clients, you may want to know a bit more about the OST file before doing your next job. IMAP can cause a lot of drama if removed in the accounts without backing up.
To show how to generate a certificate request in Exchange 2013. We show this process by using the Exchange Admin Center. Log into Exchange Admin Center.:  First we need to log into the Exchange Admin Center. Navigate to the Servers >> Certificates…
Exchange organizations may use the Journaling Agent of the Transport Service to archive messages going through Exchange. However, if the Transport Service is integrated with some email content management application (such as an antispam), the admini…
Suggested Courses

764 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question