Link to home
Start Free TrialLog in
Avatar of GreenmanITSupport
GreenmanITSupport

asked on

mail.que file goes from 0 to 4.9gig in about 40 minutes

This is quite baffeling, it started yesterday, but the mail.que file fills up to 4.9gig then crashes the MSExchangeTransport service.  This is a very small orginization, maybe 40 mailboxes all together.  The queue viewer is empty most of the time during this 40 minutes, there are a few messages going in and out, but nothing major.  

This is the process I follow to bring the Transport service back online:

http://technet.microsoft.com/en-us/library/bb124343.aspx

I was cirious, so I pulled the internet connection for about 5 minutes, and during that time the mail.que file was still constantly increasing.

Also, the edgetransport service is going crazy as well. (see screen captures 3 minutes apart)

Attached is my edgetransport.exe.config

Aside from spending the long weekend rebuilding the queue file every 40 minutes, what can I do?
<configuration>
  <runtime>
    <gcServer enabled="true" />
    <generatePublisherEvidence enabled="false" />
  </runtime>
  <appSettings>
    <add key="AgentLogEnabled" value="true" />
    <add key="ResolverRetryInterval" value="30" />
    <add key="DeliverMoveMailboxRetryInterval" value="30" />
    <add key="ResolverLogLevel" value="Disabled" />
    <add key="ExpansionSizeLimit" value="1000" />
    <add key="MaxIdleTimeBeforeResubmit" value="12:00:00" />
    <add key="MailboxDeliveryQueueRetryInterval" value="00:05:00" />
    <add key="QueueGlitchRetryInterval" value="00:01:00" />
    <add key="QueueGlitchRetryCount" value="4" />
    <add key="PFReplicaAgeThresholdHours" value="48" />
    <add key="DeferredReloadTimeoutSeconds" value="5" />
    <add key="MaxDeferredNotifications" value="20" />
    <add key="MaxQueueViewerQueryResultCount" value="250000" />
    <add key="RoutingConfigReloadInterval" value="12:00:00" />
    <add key="DumpsterAllMail" value="false" />
    <add key="DumpsterAllowDuplicateDelivery" value="false" />
    <add key="DumpsterDeletionDelayAfterStartup" value="00:02:00" />
    <add key="DatabaseCheckPointDepthMax" value="20971520" />
    <add key="DatabaseMaxCacheSize" value="134217728" />
    <add key="DatabaseCacheFlushStart" value="3" />
    <add key="DatabaseCacheFlushStop" value="5" />
    <add key="QueueDatabaseBatchSize" value="40" />
    <add key="QueueDatabaseBatchTimeout" value="100" />
    <add key="QueueDatabaseMaxConnections" value="4" />
    <add key="QueueDatabaseLoggingFileSize" value="5242880" />
    <add key="QueueDatabaseLoggingBufferSize" value="524288" />
    <add key="QueueDatabaseMaxBackgroundCleanupTasks" value="32" />
    <add key="QueueDatabaseOnlineDefragEnabled" value="true" />
    <add key="QueueDatabaseOnlineDefragSchedule" value="1:00:00" />
    <add key="QueueDatabaseOnlineDefragTimeToRun" value="3:00:00" />
    <add key="QueueDatabasePath" value="d:\queue" />
    <add key="QueueDatabaseLoggingPath" value="d:\queue" />
    <add key="IPFilterDatabasePath" value="C:\Program Files\Microsoft\Exchange Server\TransportRoles\data\IpFilter" />
    <add key="IPFilterDatabaseLoggingPath" value="C:\Program Files\Microsoft\Exchange Server\TransportRoles\data\IpFilter" />
    <add key="TemporaryStoragePath" value="C:\Program Files\Microsoft\Exchange Server\TransportRoles\data\Temp" />
    <add key="EnableResourceMonitoring" value="false" />
    <add key="ResourceMonitoringInterval" value="00:00:02" />
    <add key="PercentageDatabaseDiskSpaceUsedHighThreshold" value="0" />
    <add key="PercentageDatabaseDiskSpaceUsedMediumThreshold" value="0" />
    <add key="PercentageDatabaseDiskSpaceUsedNormalThreshold" value="0" />
    <add key="PercentageDatabaseLoggingDiskSpaceUsedHighThreshold"
      value="0" />
    <add key="PercentageDatabaseLoggingDiskSpaceUsedMediumThreshold"
      value="0" />
    <add key="PercentageDatabaseLoggingDiskSpaceUsedNormalThreshold"
      value="0" />
    <add key="PercentagePrivateBytesUsedHighThreshold" value="0" />
    <add key="PercentagePrivateBytesUsedMediumThreshold" value="0" />
    <add key="PercentagePrivateBytesUsedNormalThreshold" value="0" />
    <add key="VersionBucketsHighThreshold" value="200" />
    <add key="VersionBucketsMediumThreshold" value="120" />
    <add key="VersionBucketsNormalThreshold" value="80" />
    <add key="PercentagePhysicalMemoryUsedLimit" value="94" />
    <add key="DehydrateMessagesUnderMemoryPressure" value="true" />
    <add key="VersionBucketsHistoryDepth" value="3" />
    <add key="PrivateBytesHistoryDepth" value="30" />
    <add key="CrashOnStopTimeout" value="false" />
    <add key="DnsFaultTolerance" value="Lenient" />
    <add key="PriorityQueuingEnabled" value="false" />
    <add key="MaxPerDomainHighPriorityConnections" value="3" />
    <add key="MaxPerDomainNormalPriorityConnections" value="15" />
    <add key="MaxPerDomainLowPriorityConnections" value="2" />
    <add key="HighPriorityMessageExpirationTimeout" value="8:00:00" />
    <add key="NormalPriorityMessageExpirationTimeout" value="2.00:00:00" />
    <add key="LowPriorityMessageExpirationTimeout" value="2.00:00:00" />
    <add key="HighPriorityDelayNotificationTimeout" value="00:30:00" />
    <add key="NormalPriorityDelayNotificationTimeout" value="4:00:00" />
    <add key="LowPriorityDelayNotificationTimeout" value="8:00:00" />
    <add key="MaxHighPriorityMessageSize" value="250KB" />
    <add key="ByteEncoderTypeFor7BitCharsets" value="1" />
  </appSettings>
  <system.net>
    <connectionManagement>
      <add address="*" maxconnection="10" />
    </connectionManagement>
    <defaultProxy>
      <proxy usesystemdefault="false" autoDetect="true" />
    </defaultProxy>
  </system.net>
</configuration>

Open in new window

Edge.bmp
Edge2.bmp
Avatar of Gunter17
Gunter17
Flag of United States of America image

Take the server off the network and see if it still fills.
Avatar of GreenmanITSupport
GreenmanITSupport

ASKER

I'll see if someone can let me back in, they all left for the long weekend now, I did run netstat on all of the computers that are onsite, there weren't any odd connections, though the netstat on the server 2008 box with exchange on it had maybe 30 or 40 open tcp connections, all of the clients are using RPC over HTTP, half of them are iPhones.
Still happening, isolated the exchange server and the DC, the mail.que file is still climbing at a crazy rate... what now?
http://forums.msexchange.org/m_1800502066/mpage_1/key_/tm.htm#1800502066

Post #7 says this is a circular logging enabled Exchange database.

It is very interesting that Queue Viewer is empty.. I actually just checked my Exchange 2007 server, and the mail.que file is only 82mb

This is very interesting... Is the server on the latest SP?

This is what my queue folder looks like.. very different from yours.

cc02.jpg
So, this looks like some sort of Virus or SpamBot type action, attaches is a CSV file for 11 minutes from the EXMon utility, half way though, the mail.que file started to increase along with the page/file in the exchange performance monitor, the ? user is taking up so much and ? is what the Exmon util puts in the report.  the 10.1.1.4 address is one of the two adapter addresses for the exchange box (where the ? user is connecting from, but it looks like everyone is connecting through the exchange box as everyone is using RPC over HTTP via either outlook 07 or an iPhone.

I did install AVG SBS edition and scanned the exchange box, it found nothing (though it broke the transport service) so it has been removed since.

Any ideas on how to track this one down would be really helpful.
11-50-Sunday.csv
Could it possibly be related to the server generating NDR reports?

The "Bytes Out" part on the ? User is questionable.. Does it actually say '?' as the user?

Since we've isolated the server off the internet, and off the internal network it definately is the server generating this..

Are there any odd processess running on the box?
? is what the exmon program says...

I'll try turning off NDR's  

for exchange to work it needs to contact the AD server as well, so it could be either server?
So, disabling NDR's didn't do it (unless I missed something)  I removed the check box under the properties of the default remote domains that says "Allow Non Delivery Reports"

Is there any way to see whats in the mail.que file that's filling it up?
ASKER CERTIFIED SOLUTION
Avatar of GreenmanITSupport
GreenmanITSupport

Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial
What tool did they use to find this huge email?
I'm having the same exact problem.  Can you please explain what MS did to remove the large email from the store?