Event ID: 1221 not showing up in Application Events

tech1950
tech1950 used Ask the Experts™
on
Trying to troubleshoot an issue with Mailbox data stores growing rapidly.  Unfortunately, my Application Events do not show EVENT ID: 1221 anywhere.  It seems that the main problem is that there are too many unnecessary events filling up.  Example:  I have a ton of Event ID: 1096 Source: MSExchangeIS Mailbox Store.  Also, many informational events about who is logging on.  I've checked my logging level with PowerShell and they are all set to LOW and LOWEST so I'm not sure why I'm getting a lot of this junk.  I'm getting 7 events per second!  So, even with 55,000+ events being listed, I can only go back about 45 minutes at any given time.  So, I have no clue if my Exchange Maintenance is even running since I can't find Event ID: 1221. Is there any way to stop some of these events from being listed?  Or, is there another way to retrieve the information on the database whitespace and IF Exchange Maintenance IS or is NOT running?  Any help would be greatly appreciated!  Thank you!!
Comment
Watch Question

Do more with

Expert Office
EXPERT OFFICE® is a registered trademark of EXPERTS EXCHANGE®
Top Expert 2010

Commented:
hi
Do you have any eventSink configured for Spam filtering or something ?

Whatever is triggering your 1096 - it is probably for every email hitting your exchange. (just a guess...)
Top Expert 2010

Commented:
Check this
http://msexchangetips.blogspot.com/2006/08/exchange-how-to-view-all-registered.html

I think this is for 2003 ?

Is there anyway you can verify this > one 1096 event for every email.
What's your AV  ?

Commented:
have you increased diagnostic login? I guess this 1096 occured if any debugging login in creased .
OWASP: Threats Fundamentals

Learn the top ten threats that are present in modern web-application development and how to protect your business from them.

Top Expert 2010

Commented:
firojkhan may have a point.
Did you test it ?

Author

Commented:
Actually finally figured out that setting the MSExchangeIS\9000 Private\Logons and \9002 System\Table Cache was set to low and that setting it to lowest took care of the problem.  Thanks.
Commented:
Nevermind....That actually did NOT help.  It stopped listing all those events, but I still get a tremendous amount of informational events I actually don't need.  I guess I need to keep looking for more to set to LOW.  Example, Transport Delivering, Access Control, etc.  

Sunnyc7 / fironjkhan;  There is nothing in my Exchange 2007 Diagnostic Logging that is set higher than Low.  :(  Also, no AV running locally on the server.  All Mail is filtered by a separate device on the network and our 2003 Exchange server for another client is not having any problems going thru it.  Any other ideas?

Author

Commented:
No resolution.  Ended up upgrading to new server anyway so troubleshooting was void.

Do more with

Expert Office
Submit tech questions to Ask the Experts™ at any time to receive solutions, advice, and new ideas from leading industry professionals.

Start 7-Day Free Trial