[Okta Webinar] Learn how to a build a cloud-first strategyRegister Now

x
  • Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 620
  • Last Modified:

Exchange server eating space and processing

Hi there, I was greated yesterday morning uopn my arrival at work with the Exchange server falling over due to lack of disk space.
Now I have to admit our Exchange server is fairly old but up unitl now it has proved to do its job well enough.
Having made some "emergency" space I was able to dig around a little more. I noticied that the HDD Space had decreased rapidly over the course of a few days (another 4GB last night).
In addition to the Hard DIsk space dissapearing the memory usage is running in the high 90% - 100%. The two processes that seem to be causing this are:
1) UdaterUI.exe
2)frameworkservice.exe
Both of which are conected with McAfee I believe, but why are they running so highly. I have attempted a reinstallation but no change.
My thought turned to the possibility of a virus or something malicious like that, but having run a full scan using the latest SuperDAT and alos running a scan for Spyware, nothing was found of any serious issue.

Does anyone have any advice to solve the performance and Hard Disk issues?
0
InfamousMule
Asked:
InfamousMule
  • 7
  • 3
  • 3
1 Solution
 
bobsyeruncleCommented:
Have your backups of Exchange been successful?  It may be that your transaction log files have not been cleared.

If your backups have been running then check here:

http://technet.microsoft.com/en-us/library/aa996191(EXCHG.65).aspx
0
 
sealviewCommented:
About the HDD issue, take a look in the Exchange Log files, the path to them is this:

%Program Files%\Exchsrvr\MDBDATA\

You might have a lot of log files there that eat up tour hard drive. You can safely remove them after you have made a copy of them onto an external storage, only if you need them.

ATTENTION!
The files that contains log only are named with E000xxxx.log and each max volume is 5.120 KB, DO NOT remove any other files!
If this is not clear enough, PLEASE ASK!
0
 
InfamousMuleAuthor Commented:
Hi there bobsyeruncle - the Backups have been failing over the last two nights, I assumed this was due to server crashing etc.
How do I manually clear down the transaction log files?

sealview - thanks for this, I had taken into account the Exchange log files and cleared them down. Thanks
0
When ransomware hits your clients, what do you do?

MSPs: Endpoint security isn’t enough to prevent ransomware.
As the impact and severity of crypto ransomware attacks has grown, Webroot fought back, not just by building a next-gen endpoint solution capable of preventing ransomware attacks but also by being a thought leader.

 
bobsyeruncleCommented:
Basically the log files contain every transaction that is made to the database.  If your exchange database failed at 1pm today, you could restore from your last full backup (say 11 pm last night)  then roll forward to 12:55pm using your transaction logs.  Exchange will not delete these transaction logs until a full backup is run.  What backup software do you use?  It might be worth using NTBackup (built into Windows) to run a backup of exchange to an external hard disk?  Or you could change your exchange logging to "Circular" which will overwrite log files.  Obviously the downside of this is the disaster recovery.  You could also change to Circular temporary to clear the log files and then change back to Full.

If it does become a big problem you may want to log at upgrading or adding extra disks to the server.



0
 
InfamousMuleAuthor Commented:
We are using Backup Exec 11. I will look in to your suggestion though. Thank you.
0
 
InfamousMuleAuthor Commented:
Anyone Any ideas on the Processes?

UdaterUI.exe is causing the system to 100%
0
 
bobsyeruncleCommented:
You probably need to configure McAfee to exclude the Exchange directories if it is just scanning the full disk.  See here:

http://support.microsoft.com/kb/823166
0
 
sealviewCommented:
It seems to me that it's more an update to McAfee issue since the UpdaterUI is the daemon of McAfee handling the sync with the UpdateServer from NAI.
I know you have scanned with the latest SuperDAT, but did you install it also.
Have you tried a manual update to McAfee (right click system tray icon - Update Now..)?
0
 
InfamousMuleAuthor Commented:
Ok The transaction logs appear fine. No issue there.

The Public Folder however is growing before my eyes and the processes are still going crazy.

Virus Related?
0
 
InfamousMuleAuthor Commented:
The right click update option will not allow me to update......................
0
 
sealviewCommented:
Uninstall the McAfee.
Restart.
Install McAfee back.
Restart.

If the problem persists!?
Even if this is not the answer you need to hear, you should make a virus scan with an AntiVirus other than McAfee, and if it is possible from another OS with your server not loaded.
0
 
InfamousMuleAuthor Commented:
Hi there, bit of  a red herring.... Maybe?!?!?!

I have uninstalled MacAfee and sure enough the processes have stopped. The space has levelled on the Exchange Server.
I think the space issue may of been down to the MSScript.log and the  MSScript.bak files growing... and growing... and growing.... you get the picture.
Having looked at the log file it seems it only cause an issue when it trys to update the virus DAT files... The log shows it trys, connects and fails.... heres a section.....
20090422155732: AKOS-EXCH: ScriptEngine: AKOS-EXCH      Error occurred while loading COM componet:.
20090422155732: AKOS-EXCH: ScriptEngine: AKOS-EXCH      Error occurred while getting point product callback component interface.
20090422155732: AKOS-EXCH: ScriptEngine: AKOS-EXCH      ************ [EnumerateThroughProducts] : ProdID: FALSE
20090422155732: AKOS-EXCH: ScriptEngine: AKOS-EXCH      ************ [GetPlugInUsingRegistry] : ProdID:FALSE
20090422155732: AKOS-EXCH: ScriptEngine: AKOS-EXCH      ************ [GetRegValue] : HKLM\SOFTWARE\Network Associates\ePolicy Orchestrator\Application Plugins\FALSE, CLSID
20090422155732: AKOS-EXCH: ScriptEngine: AKOS-EXCH      Error occurred while loading COM componet:.

So it may be that the only space being used up is by the log files, so as long as I can resolve this, great... but why cant MacAfee update and when it trys over and over, fails, and creates a massive log!?
0
 
InfamousMuleAuthor Commented:
Ok just to put a wrap on this one.
McAfee was corrupted and no matter how I removed it and reistalled it, the issue continued.
This is because in c:\documents and settings\all user\ Applications\..... the was a Mcafee log file that adds data each time the Macaffee Software failes to update..... Every 5 seconds! So the log file was around 2GB when I found it. However each evening the log file also gets backed up - so that 2GB also gets backed up into a .bak file then the log file starts again from there - growing to 4GB ...... and so it went on!
To get rid of this, Unistall McAfee, stop all related processes in Task manager - then deleted the log file and bak file.
Voila - I have my space back!
0

Featured Post

Nothing ever in the clear!

This technical paper will help you implement VMware’s VM encryption as well as implement Veeam encryption which together will achieve the nothing ever in the clear goal. If a bad guy steals VMs, backups or traffic they get nothing.

  • 7
  • 3
  • 3
Tackle projects and never again get stuck behind a technical roadblock.
Join Now