Why Experts Exchange?

Experts Exchange always has the answer, or at the least points me in the correct direction! It is like having another employee that is extremely experienced.

Jim Murphy
Programmer at Smart IT Solutions

When asked, what has been your best career decision?

Deciding to stick with EE.

Mohamed Asif
Technical Department Head

Being involved with EE helped me to grow personally and professionally.

Carl Webster
CTP, Sr Infrastructure Consultant
Ask ANY Question

Connect with Certified Experts to gain insight and support on specific technology challenges including:

Professional Opinions
Ask a Question
Did You Know?

We've partnered with two important charities to provide clean water and computer science education to those who need it most. READ MORE

troubleshooting Question

Submission Queue backing up

Avatar of ITSCSomerset
ITSCSomerset asked on
2 Comments1 Solution4333 ViewsLast Modified:
Hi All,

We're running an exchange 2007 set-up, we have two dedicated hub servers both running forefront, but i've had to suspend the 2nd hub server as the submission queue is backing up (8k atm) and the CPU is getting hammered, 100% constant.
The event viewer is showing events such as :

Event Type:      Information
Event Source:      FSCTransportScanner
Event Category:      Scan Results
Event ID:      3002

Internet scan found virus:
   Folder: SMTP Messages\Outbound
   Message: RE: FORM 11 - M10 RECODE
   Message ID: <msg-id-editted>
   File: winmail.dat
   Incident: Exceeded Internet Timeout
   State: Detected
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.


Event Type:      Error
Event Source:      FSEAgent
Event Category:      Scan Error
Event ID:      5015
Transport scan exceeded the allowed scan time limit.
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp


Event Type:      Warning
Event Source:      MSExchange Extensibility
Event Category:      MExRuntime
Event ID:      1050

The execution time of agent 'FSE Routing Agent' exceeded 300000 (milliseconds) while handling event 'OnSubmittedMessage'. This is an unusual amount of time for an agent to process a single event. However, Transport will continue processing this message.
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

i've tried looking a the transport agents running on the box, it shows 3 enabled and 1 disabled (AD RMS Prelicensing Agent is disabled) I've tried stopping the FSE routing Agent, but the queue still continued to back up, i've tried disableing the transport rule agent and the ssytem continued to back up...i've re-enabled them and no luck, restarted all services etc...but i can't get the submission queue to become active and start processing again. the queue was not suspended or anything either.

to get things going i've stopped the transport service on the affected device, all mails now routing through the other...this is processing fine and finding no viruses.
I'm obviously suspecting a problem with forefront causing this...i'm thinking i'm going to have to disable or uninstall it from the device in question and see if the queue will start processing messages again.
given that the other hub is processing fine i think its either; a problem with the forefront install on the device in general, or possibly that its hanging on one particular message, and not processing any others until its cleared it...the 3rd event id error listed above have been re-appearing consistantly since the problem began last night.

do we all think uninstall of forefront is the way to go (obviously its going to need to be re-installed again later) or is there another trick that i havent tried?

thanks in advance for any assistance.
Avatar of Justin Durrant
Justin DurrantFlag of United States of America imageSr. Engineer - Windows Server/Virtualization

Our community of experts have been thoroughly vetted for their expertise and industry experience.

This problem has been solved!
Unlock 1 Answer and 2 Comments.
See Answers