Avatar of ITSCSomerset
ITSCSomerset
 asked on

Submission Queue backing up

Hi All,

We're running an exchange 2007 set-up, we have two dedicated hub servers both running forefront, but i've had to suspend the 2nd hub server as the submission queue is backing up (8k atm) and the CPU is getting hammered, 100% constant.
The event viewer is showing events such as :

Event Type:      Information
Event Source:      FSCTransportScanner
Event Category:      Scan Results
Event ID:      3002

Internet scan found virus:
   Folder: SMTP Messages\Outbound
   Message: RE: FORM 11 - M10 RECODE
   Message ID: <msg-id-editted>
   File: winmail.dat
   Incident: Exceeded Internet Timeout
   State: Detected
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

And:

Event Type:      Error
Event Source:      FSEAgent
Event Category:      Scan Error
Event ID:      5015
Description:
Transport scan exceeded the allowed scan time limit.
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp

Also:

Event Type:      Warning
Event Source:      MSExchange Extensibility
Event Category:      MExRuntime
Event ID:      1050

Description:
The execution time of agent 'FSE Routing Agent' exceeded 300000 (milliseconds) while handling event 'OnSubmittedMessage'. This is an unusual amount of time for an agent to process a single event. However, Transport will continue processing this message.
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

i've tried looking a the transport agents running on the box, it shows 3 enabled and 1 disabled (AD RMS Prelicensing Agent is disabled) I've tried stopping the FSE routing Agent, but the queue still continued to back up, i've tried disableing the transport rule agent and the ssytem continued to back up...i've re-enabled them and no luck, restarted all services etc...but i can't get the submission queue to become active and start processing again. the queue was not suspended or anything either.

to get things going i've stopped the transport service on the affected device, all mails now routing through the other...this is processing fine and finding no viruses.
I'm obviously suspecting a problem with forefront causing this...i'm thinking i'm going to have to disable or uninstall it from the device in question and see if the queue will start processing messages again.
given that the other hub is processing fine i think its either; a problem with the forefront install on the device in general, or possibly that its hanging on one particular message, and not processing any others until its cleared it...the 3rd event id error listed above have been re-appearing consistantly since the problem began last night.

do we all think uninstall of forefront is the way to go (obviously its going to need to be re-installed again later) or is there another trick that i havent tried?

thanks in advance for any assistance.
SoftwareExchange

Avatar of undefined
Last Comment
ITSCSomerset

8/22/2022 - Mon
ASKER CERTIFIED SOLUTION
Justin Durrant

THIS SOLUTION ONLY AVAILABLE TO MEMBERS.
View this solution by signing up for a free trial.
Members can start a 7-Day free trial and enjoy unlimited access to the platform.
See Pricing Options
Start Free Trial
GET A PERSONALIZED SOLUTION
Ask your own question & get feedback from real experts
Find out why thousands trust the EE community with their toughest problems.
ITSCSomerset

ASKER
thats what i did as well yes. it fixed the issues, although i am going to try and re-install FF on the device and activate it again
I started with Experts Exchange in 2004 and it's been a mainstay of my professional computing life since. It helped me launch a career as a programmer / Oracle data analyst
William Peck