Solved

Exchange store service hangs in SBS2003

Posted on 2009-05-12
16
1,008 Views
Last Modified: 2012-06-27
For the last few weeks our exchange has been becoming unavailable to clients, outlook just freezes up and cannot retrieve data.

Checking the service list the information store is still running, when I select the service adn either select stop or restart it fails to stop correctly.  At this point if I manually end the store.exe process and then start the service again it comes back up, the pop3 email connector doesn't actually work until it's restarted as well.

I've updated our trend micro anti virus which has been running on the server since day 1 (about 2 years ago) and I've unmounted the stores and run both ESEUTIL and ISUTIL through them with zero errors, they remounted just fine.

I've done everything I can think of, updated all the applications, run all the microsoft updates and service packs, it's still happening every 2-3 days, it doesn't seem to coincide with any particular event like backups or people using OWA.

Any help appreciated
0
Comment
Question by:princess_frosty
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 9
  • 6
16 Comments
 
LVL 52

Expert Comment

by:Manpreet SIngh Khatra
ID: 24362141
Can you for a couple of days stop and disable the third party applications?
What is the size of the database (.edb and .stm)?
0
 
LVL 52

Expert Comment

by:Manpreet SIngh Khatra
ID: 24362147
Is there any event id for ESE or MSExchangeIS with id as 1000 for hang.
0
 

Author Comment

by:princess_frosty
ID: 24362305
priv1.stm = 27.7Gb
priv1.edb = 27.1Gb
pub1.stm = 131Mb
pub1.edb = 45Mb

The most recent defrag 1221 event reports "The database "First Storage Group\Mailbox Store (***)" has 3831 megabytes of free space after online defragmentation has terminated."

So it's not a space thing, that I can work out.

I could potentially stop the backup services from running, I'm a bit worried about stopping the Antivirus however, the trend micro mail add on scans incoming mails and strips out any viruses.

We weren't getting a lot of errors surrounding this problem which has made it a lot harder to troubleshoot, I've just checked the event viewer for sunday which is when the store last went down, at about 11am we get errors in the application log with EventID 1023 with a source of IMAP4SVC.

It looks like 2 speciifc users are getting these errors over and over:

Error 0x8004050a occurred while rendering message 0001-000000b4dcf4 for download for user ****@*********.co.uk.

The only thing I can think of that these 2 users have in common that other users do not is that they have their iphones set up to connect via IMAP to the server to retrieve mails (and use SMTP to send), but it's unclear if this is a cause of the problems or seeing these errors is simply a symptom of exchange failing.

Maybe I should stop the IMAP service and see if that helps?  Nothing other than the Iphones use it, and thats only because the exchange setup on the iphone is awkward and fails.
0
Resolve Critical IT Incidents Fast

If your data, services or processes become compromised, your organization can suffer damage in just minutes and how fast you communicate during a major IT incident is everything. Learn how to immediately identify incidents & best practices to resolve them quickly and effectively.

 

Author Comment

by:princess_frosty
ID: 24362341
I forgot to mentio, these IMAP4SVC errors continue until about 17:00 at which point one of our admins had logged on and we get a single error below

EventID 1005
Source MSExchangeSA
Unexpected error <<0xc1050000 - Network problems are preventing connection to the Microsoft Exchange Server computer. An unexpected, unknown error has occurred. Microsoft Exchange Server Information Store ID no: 80040115-0514-000006b5>> occurred.

Followed by

EventID 1005
Source MSExchangeSA
Unexpected error <<0xc1050000 - The Microsoft Exchange Server computer is not available. Either there are network problems or the Microsoft Exchange Server computer is down for maintenance. The MAPI provider failed. Microsoft Exchange Server Information Store ID no: 8004011d-0526-00000000>> occurred.

And then multiple instances of:

EventID 9175
Source MSExchangeSA
The MAPI call 'OpenMsgStore' failed with the following error:
The Microsoft Exchange Server computer is not available.  Either there are network problems or the Microsoft Exchange Server computer is down for maintenance.
The MAPI provider failed.
Microsoft Exchange Server Information Store
ID no: 8004011d-0526-00000000

Which I presume is the outlook clients failing to connect...this goes on until 17:16 when the service is manually stopped (which fails) and the process store.exe is killed, then the service is restarted.
0
 
LVL 52

Accepted Solution

by:
Manpreet SIngh Khatra earned 125 total points
ID: 24362413
What is the set size of the Database with the Registry "Database size limit in Gb" as the database is about 55Gb. Also the event ID 1005 and 9175 shows that the Stores may be down at this time.

Can you do one thing try stopping the IMAP and also go to regedit
HKLM\System\CCS\Services\MSExchangeIS\VIrusScan (May or may not be)
and then find Enabled and Background scanning and make the value to 0.

Can you also verify that at this time if the stores are mounted or not.
0
 
LVL 52

Expert Comment

by:Manpreet SIngh Khatra
ID: 24362419
What is the time when the Backup and Antivirus work?
What Antivirus do we have and were any updates done to them?
If its a file scanner do we have exclusions set for the Exchange database and other files to be excuded?
0
 

Author Comment

by:princess_frosty
ID: 24362459
Database Size Limit in GB is 60, this seems consistent as the free space being recoded by online defrag is about 4gb and we're using about 55.

Background scanning was already set to 0, I've set enabled to 0 also now.

Right now the stores are mounted, I unmounted them last night for the integrity checks but they were re-mounted about 2am.

Do i need to restart all the exchange services to pick up this registry change?
0
 
LVL 52

Expert Comment

by:Manpreet SIngh Khatra
ID: 24362493
If possible and also as i asked is this a File scanner as well and are exclusions set on them?
Also you can run the msconfig command and hide all microsoft services and verify the other third parties and see if there is anything that might cause the issue
0
 

Author Comment

by:princess_frosty
ID: 24362494
We run Symantec backup service which runs most of time since our backups take all day, and we run trend microscan, the server client is installed and so is the email live scan, but they have been since day1, both are up to date.

I can't find scan settings for the standard antivirus, its a fairly dumb little client agent that just does realtime scanning, I've forced it to scan the exchange dbdata folder with a full scan and it doesn't cause any negative side effects, it's built to work with MS/Exch so I'm not convinced that is the cause.
0
 

Author Comment

by:princess_frosty
ID: 24362521
The only other services running are grouped into

HP services for various features like Proliant and the RAID management
Trend microscan agents for antivirus and proxy service
Backup Exec agents
FTP service
SQL (Sharepoint)

And and few other bits and bobs which shouldn't cause any problems like services to monitor routers etc.
0
 
LVL 52

Expert Comment

by:Manpreet SIngh Khatra
ID: 24362575
First of all the Antivirus should never ever scan the Exchange DB, Logs ,Exchsrvr, Inetpub and Inetsrv folders.
Secondly what time is the Backups scheduled to run and what kind of backups are these (Online, Offline, VSS, Brick level or what)?
0
 

Author Comment

by:princess_frosty
ID: 24362607
I can't see any significant control over the scanning options for the security agent, it just realtime scans and thats about it, again scanning the store doesn't result in a problem, I specifically tried this to rule it out.

Backups are scheduled to run at 11pm, tapes are changed at 8-9am in the morning for the 2nd set and 3rd set is usually mid day.  It doesn't run on sunday which is when the store went down last, as I said in my original post it doesn't seem to coincide with backup times.  

Besides these are server based tools designed to work in this environement and have worked fine for 2 years with no change to their configuration.  They're online backups.
0
 
LVL 65

Expert Comment

by:Mestha
ID: 24363348
Is your backup large or going to slow storage? A backup shouldn't run all day.
Something I see a lot with Backup Exec is where people select the Information Store, Mailboxes and Public Folders, which is just unnecessary. You only need the information store for a valid backup of Exchange, Mailboxes and Public Folders do not need to be selected and is a very slow method of backup. It is also close to useless for most recovery scenarios.

What else is on the machine? I find Exchange is usually very reliable.

Have you run the SBS Best practises tool (free download from MS) against the system?

Simon.
0
 

Author Comment

by:princess_frosty
ID: 24366114
It's an SBS box it's deisnged to do everything for the business, exchange, domain controller and SQL database are the main functions.

The tape backup is about 40gb per tape and requires 3 tapes to do a full backup, so to get daily backups it runs most of the day.

Exchange HAS been very reliable for basically 2 years, its just the last few weeks this has been happening, I'm going to leave the IMAP4 server stopped and leave the antivirus "enabled" reg key set to 0 for exchange and see if that helps, I will check back in a few days with a yay or nay, thanks.
0
 

Author Comment

by:princess_frosty
ID: 24412351
So far so good, no crashes yet, for some reason the IMAP4 service has started again it maybe because some updates were applied recently (but not restarted yet)

I'll reboot the server tonight and make sure the IMAP4 service is running and see if it remains stable.
0
 

Author Closing Comment

by:princess_frosty
ID: 31580434
Thanks for the help, it looks like since the IMAP4 service started again at some point that it must be the registry change I made...

It doesn't make much sense to me, trend micro is designed for servers and had been running for years without issue, but it seems to be working so at least I have some stability back, thanks!
0

Featured Post

Office 365 Training for Admins - 7 Day Trial

Learn how to provision tenants, synchronize on-premise Active Directory, implement Single Sign-On, customize Office deployment, and protect your organization with eDiscovery and DLP policies.  Only from Platform Scholar.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Lotus Notes – formerly IBM Notes – is an email client application, while IBM Domino (earlier Lotus Domino) is an email server. The client possesses a set of features that are even more advanced as compared to that of Outlook. Likewise, IBM Domino is…
Following basic email etiquette rules will help you write a professional email and achieve a good, lasting impression with your contacts.
In this video we show how to create an Accepted Domain in Exchange 2013. We show this process by using the Exchange Admin Center. Log into Exchange Admin Center.: First we need to log into the Exchange Admin Center. Navigate to the Mail Flow >> Ac…
To show how to create a transport rule in Exchange 2013. We show this process by using the Exchange Admin Center. Log into Exchange Admin Center.: First we need to log into the Exchange Admin Center. Navigate to the Mail Flow >> Rules tab.:  To cr…

759 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question