Link to home
Start Free TrialLog in
Avatar of ITSCSomerset
ITSCSomerset

asked on

Submission Queue backing up

Hi All,

We're running an exchange 2007 set-up, we have two dedicated hub servers both running forefront, but i've had to suspend the 2nd hub server as the submission queue is backing up (8k atm) and the CPU is getting hammered, 100% constant.
The event viewer is showing events such as :

Event Type:      Information
Event Source:      FSCTransportScanner
Event Category:      Scan Results
Event ID:      3002

Internet scan found virus:
   Folder: SMTP Messages\Outbound
   Message: RE: FORM 11 - M10 RECODE
   Message ID: <msg-id-editted>
   File: winmail.dat
   Incident: Exceeded Internet Timeout
   State: Detected
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

And:

Event Type:      Error
Event Source:      FSEAgent
Event Category:      Scan Error
Event ID:      5015
Description:
Transport scan exceeded the allowed scan time limit.
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp

Also:

Event Type:      Warning
Event Source:      MSExchange Extensibility
Event Category:      MExRuntime
Event ID:      1050

Description:
The execution time of agent 'FSE Routing Agent' exceeded 300000 (milliseconds) while handling event 'OnSubmittedMessage'. This is an unusual amount of time for an agent to process a single event. However, Transport will continue processing this message.
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

i've tried looking a the transport agents running on the box, it shows 3 enabled and 1 disabled (AD RMS Prelicensing Agent is disabled) I've tried stopping the FSE routing Agent, but the queue still continued to back up, i've tried disableing the transport rule agent and the ssytem continued to back up...i've re-enabled them and no luck, restarted all services etc...but i can't get the submission queue to become active and start processing again. the queue was not suspended or anything either.

to get things going i've stopped the transport service on the affected device, all mails now routing through the other...this is processing fine and finding no viruses.
I'm obviously suspecting a problem with forefront causing this...i'm thinking i'm going to have to disable or uninstall it from the device in question and see if the queue will start processing messages again.
given that the other hub is processing fine i think its either; a problem with the forefront install on the device in general, or possibly that its hanging on one particular message, and not processing any others until its cleared it...the 3rd event id error listed above have been re-appearing consistantly since the problem began last night.

do we all think uninstall of forefront is the way to go (obviously its going to need to be re-installed again later) or is there another trick that i havent tried?

thanks in advance for any assistance.
ASKER CERTIFIED SOLUTION
Avatar of Justin Durrant
Justin Durrant
Flag of United States of America image

Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial
Avatar of ITSCSomerset
ITSCSomerset

ASKER

thats what i did as well yes. it fixed the issues, although i am going to try and re-install FF on the device and activate it again