Exchange 2003 Priv Store Growing Rapidly

I have a exchange store that was 18 gbs 3 days ago, now it is over 55gbs.  Total mailbox size from esm is less then 10gbs.  I 've removed deleted item mailbox retention and forced online defrag and was watching store grow, like really fast grow.  We've disabled our anti virus no help.  All exchange services have been stopped including smtp.  And store stops growing.  If we dismount the store in esm, but leave the system attend and information store service running the edb grows.  Any suggestions?  Thanks!  

...background this is a SBS 2003 server with latest service packs.
HelixIncAsked:
Who is Participating?
 
AkhaterConnect With a Mentor Commented:
thank you for the update
0
 
HelixIncAuthor Commented:
So our next plan of attack is to copy the stm and edb to another location and user power tools to grab pst's.  Once the copy is done and while power tools is running we are going to do eseutil /p, then /d, then isinteg.  I'll keep you posted.  Still open to ideas however.
0
 
AkhaterCommented:
can you please tell us what is growing ? is it the stm file ? the edb file or the log files ?
0
Easily manage email signatures in Office 365

Managing email signatures in Office 365 can be a challenging task if you don't have the right tool. CodeTwo Email Signatures for Office 365 will help you implement a unified email signature look, no matter what email client is used by users. Test it for free!

 
HelixIncAuthor Commented:
Priv EDB.
0
 
AkhaterCommented:
are you sure the edb file is growing even if the store is dismounted ????????????

that sounds very weird. if the store is dismounted nothing shou go inside the edb file !



0
 
HelixIncAuthor Commented:
It's the craziest thing i think i have ever seen.  But I was watching the EDB grow with store dismounted, but system attend and info store process still running.
0
 
AkhaterCommented:
i have to admit i have never seen such a thing .

since it is the edb growing i will have to rule out antivirus

I don't think the defrag will do you any good.

what if you stop the smtp service ?

the information store ?

0
 
HelixIncAuthor Commented:
Yes. We started by stoping the all protocols in the ESM. Stopping SMTP service, Scanmail Services, and each MS exchange service 1 by 1. With the last 2 critcals (sys attend. & info store started in the services) we tried just dismounting the store from ESM. Just the priv1.edb file would continue to grow at rapid rate. By stopping the info store process the EDB would stop growing. We administor many exchange box over the years, and have never seen something like this.

Related products (also disabled) BES & Fax Connector. These servers are off, and according services on the SBS server are disabled.

0
 
HelixIncAuthor Commented:
Thank you Akhater; I had not ran across that article. We will go through those items and post back.We have tried the typical forum solutions like Out-of-Office Assit. and Possible mail loops. The users mailboxs have not grown a single item while the growth occurs.
0
 
AkhaterCommented:
:\

can you afford to create a new  storage group and mailbox store and start moving your mailboxes to it ?
0
 
HelixIncAuthor Commented:
Yes, but its a one way ticket ;\. SBS only allows for a single Store (Priv/Pub). So indeed we would have to nuke the rogue priv store and recreate a clean one.

We have backups, and copies of the raw EDB &STM files. And the software to export the data.

0
 
AkhaterCommented:
oops i forgot the sbs part ! sorry my bad

0
 
AkhaterCommented:
do you have journaling enabled ?
0
 
HelixIncAuthor Commented:
It is not enabled.
0
 
HelixIncAuthor Commented:
so we nuked it.  put in a brand new priv1.edb and it started growing.  UN-REAL!
0
 
HelixIncAuthor Commented:
Looks like a user mailbox was causing the issue.  Went through and removed all mailboxes and store has stopped growing unfortunately we did them all at once, so we don't know who exactly.  After turning on granular logging from the link above we noticed one user flooding the event log.  We deleted his box, but store was still growing.  That made us decide to wipe all mailboxes.  Looks like it's time to create new boxes and re-importing data.  UHHGGGGG......!!!!  Keep this thread alive until we have it back up at 100%
0
 
AkhaterCommented:
keep us posted
0
 
HelixIncAuthor Commented:
So all new mailboxes re-attached and data re-imported. So far store looks to be maintaining like normal. Were going to let the maint run tonight and see how it looks tomorrow. We'll let everyone on monday for sure when we have to put the store back into production. Thanks for the input today Akhater. That link was really useful.
0
 
HelixIncAuthor Commented:
So everything seems to be working today.
0
 
HelixIncAuthor Commented:
Final outcome.

Deleting the store, re-creating it (keep in mind nothing done at the AD level). The mailbox's like they should recreated and the store immediately started re-growing. Clearly a user mailbox issue. But were unable to track it down in a timely fashion.  

Had to removed all mailboxs/attribs from AD, and recreate. Re-Imported PST files using Ontrack, and all is well and healthy.

That was a strange one. Sometimes the answer is just bite the bullet.
0
 
HelixIncAuthor Commented:
Akhater had all the right info, it didn't solve the problem ultimately, but by far the best advise in this situation. Thank you.
0
All Courses

From novice to tech pro — start learning today.