Solved

Store.exe CPU Utilization at 100% on Exchange 2003

Posted on 2009-04-03
14
1,592 Views
Last Modified: 2012-05-06
We have an Exchange server for our company email; and just this week we've been having problems with the store.exe process running at 100% cpu utilization.  It's been a very stable system for many years, but it just started up this week and I'm at a loss for what could be causing the problem.  While the store is running at 100%, employees are unable to access email through Outlook or OWA.  Every now and then a few messages might sneak through, but they are usually delayed between 15 minutes and 2 hours.

I could use some assistance trouble-shooting the problem.
0
Comment
Question by:ellisgolf
  • 4
  • 4
  • 3
  • +2
14 Comments
 
LVL 65

Assisted Solution

by:Mestha
Mestha earned 20 total points
ID: 24065425
What else is on the system? Store.exe usually points to one thing - AV software. It is always the first place I look. Ensure that any file level AV isn't scanning the store. If you have Exchange integrated AV then that could also cause the problem, particularly if it is Symantec's.

Simon.
0
 
LVL 9

Assisted Solution

by:cmorffew
cmorffew earned 20 total points
ID: 24065505
Had this problem too it was something to do with the /3GB switch for your boot.ini and memory allocation.  Looking for the article now....
0
 
LVL 9

Expert Comment

by:cmorffew
ID: 24065525
Here it is..
http://support.microsoft.com/kb/823440

I have used both switch's/USERVA=3030 and the /3GB and haven't had an issue again.
0
 

Author Comment

by:ellisgolf
ID: 24065675
We do have Symantec Mail Security for Microsoft Exchange ---- it's been there for years and years, though, without any issues.  If that is the suspected problem, what can I do to test out that theory?  Our regular Systems Administrator is out for the weekend and I'm the lucky person who gets to fill in --- no experience with Symantec Mail Security or deep experience with Exchange; but capability and willingness to learn and learn quickly.
0
 

Author Comment

by:ellisgolf
ID: 24065692
....i.e, how do I safely stop the Symantec Mail Security engine and eventually restart?
0
 
LVL 9

Expert Comment

by:cmorffew
ID: 24067635
does your boot.ini already have the switches?

Why would you want to stop the security engine?  All you need to do is add an exception so that it does not scan the store.exe file.
0
 

Author Comment

by:ellisgolf
ID: 24069442
From what I understand, the Mail Security Engine only scans messages.  It isn't a file-scanner type of anti-virus.  I'll take a look at the boot.ini and report back...
0
PRTG Network Monitor: Intuitive Network Monitoring

Network Monitoring is essential to ensure that computer systems and network devices are running. Use PRTG to monitor LANs, servers, websites, applications and devices, bandwidth, virtual environments, remote systems, IoT, and many more. PRTG is easy to set up & use.

 
LVL 65

Expert Comment

by:Mestha
ID: 24069450
Here is your problem: "Symantec Mail Security for Microsoft Exchange"
I operate a simply policy with Symantec products. Anything odd going on with the server with Symantec installed, the problem is the Symantec product unless shown otherwise by its complete removal. In most cases removing it does in fact resolve the issue.

Disabling it is not enough, as the hooks remain in the system, it needs to be removed and rebooted.

If you go back through my posts both under this ID and Sembee, you will find I have been fairly consistent on this and fairly consistent on the cause of the issue being Symantec.

Oh and the fact that product has worked for years before without any issues does not mean it will continue to do so. AV is a living software product which updates frequently - problems with it are well known and will happen to all of them.

Simon.
0
 
LVL 42

Assisted Solution

by:paulsolov
paulsolov earned 20 total points
ID: 24069676
I disagree with Mestha, with SMSE you should be able to turn off both of the Symantec Mail Security Services and do a test.  Make sure there are no services stuck in "stopping" or "starting" mode as well.  If you're running local anti-virus on the system make sure you are excluding the exchange information store directories as well as exchange root folder, this may cause an issue as well.
0
 
LVL 65

Expert Comment

by:Mestha
ID: 24069734
paulsolov - you don't know enough about the way that Exchange based av products hook in to Exchange. With the services disabled they can still affect things because the hooks are still there. The only way to show it isn't the product is to remove it. This is unique to the way that Exchange and AV products hook together. You can disable Windows AV and not see any problems, but Exchange AV is handled in a different way.

Simon.
0
 
LVL 42

Expert Comment

by:paulsolov
ID: 24069839
I have installed a several hundred of these installs over the years and SMSE may cause issues but can usually be disabled via services.msc to test.  Local AV is different and needs to be modified so that EDB, STM, LOG files are not scanned which may cause issues.  

There were a few issues with Symantec Mail Security for Exchange with the older versions but the newer ones are a bit more stable.  With SMSE you can uninstall and re-install without a reboot btw.
0
 
LVL 65

Expert Comment

by:Mestha
ID: 24071897
The only way to ensure that its hooks are removed is to reboot the server. There is nothing that Symantec can do about that, it is just the nature of the way the hooks in to Exchange work. Symantec may not prompt you for a reboot, but it will be required. The reboot is only required if something cannot be removed that would affect the system's stability.

Simon.
0
 
LVL 10

Assisted Solution

by:kevala
kevala earned 20 total points
ID: 24072178
If you'd like to take Symantec out of the picture ("mostly") without uninstalling, you can:

1. Set all Symantec services to disabled
2. Open regedit, navigate to HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\MSExchangeIS\VirusScan
3. Set the Enabled value to 0
4. Reboot the server

These combinations will help prevent the antivirus DLLs from loading into memory, and the reg key removes the AV hook into the store/ESE.

I find in most of the cases i work, if Symantec is causing the issue, this is enough to prove it.
HOWEVER, in some (fewer) cases, a complete removal is required.
0
 

Accepted Solution

by:
ellisgolf earned 0 total points
ID: 24205304
Ok ---- so an update.  It is not related to the anti-virus, but it was related to a service that had been connecting to Exchange via POP3.  Everything appears to be back to normal for the time being.
0

Featured Post

How does your email signature look on mobiles?

Do your employees use mobile devices to reply to emails? With mobile becoming increasingly important to the business world, it is in your best interest to make sure that your email signature looks great across all types of devices.

Join & Write a Comment

"Migrate" an SMTP relay receive connector to a new server using info from an old server.
This process describes the steps required to Import and Export data from and to .pst files using Exchange 2010. We can use these steps to export data from a user to a .pst file, import data back to the same or a different user, or even import data t…
To add imagery to an HTML email signature, you have two options available to you. You can either add a logo/image by embedding it directly into the signature or hosting it externally and linking to it. The vast majority of email clients display l…
how to add IIS SMTP to handle application/Scanner relays into office 365.

747 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

16 Experts available now in Live!

Get 1:1 Help Now