[Okta Webinar] Learn how to a build a cloud-first strategyRegister Now

x
  • Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 989
  • Last Modified:

Exchange 2003 mailbox store growing at fast rate

I have a SBS 2003 Box (exchange 2003) that all of a sudden ran out of space early this morning and brought everything to a halt. I freed up all the space I could on the partition, around 1-2GB, but later in the day the free space was gone again.

I took a closer look and found that the mailbox store (priv1.edb) was growing by a MB or so every second. I dismounted the mailbox store and ran isinteg.exe /s <server> -fix /t d: -test ALLTESTS. It ran through 21 tests and only made two "fixes" during the "folders" test.

I mounted the database and found that the rate at which the database is growing has slowed, but is still completely unacceptable. I have run though 400MB in less than 4 hours and I have once again dismounted the database.

Where do I go from here? I was going to run an offline defrag on the mailbox store, but I have no space left on the drive. If this is the next move, how do I go about defragging without any disk space?
0
tvacc
Asked:
tvacc
  • 9
  • 5
  • 2
3 Solutions
 
tvaccAuthor Commented:
I should specify: is there a way to go about specifying another drive/partition to store the data during the defrag like there is with isinteg?
0
 
rjpilcherCommented:
You can do an offline defrag to a mapped drive or even a USB drive

eseutil /d <database path> /t<drivepath\temp.edb>

Also, you might want to see if you can take a look at the mailflow, or identify any mailboxes that may be growing - you could have a mail loop occurring.
0
 
tvaccAuthor Commented:
Also, how can I tell if the growth is caused by mail coming in repeatedly?
0
NEW Veeam Agent for Microsoft Windows

Backup and recover physical and cloud-based servers and workstations, as well as endpoint devices that belong to remote users. Avoid downtime and data loss quickly and easily for Windows-based physical or public cloud-based workloads!

 
Alan HardistyCommented:
Disable the POP3 service - it should prevent any POP3 downloading to Exchange which will cause a mail-loop as described above.

Then see if the store stops growing madly - if it does - you then need to find the client that has configured POP3 to pull mail and deliver it to Exchange!
0
 
tvaccAuthor Commented:
I think I may have some more useful information. I am down to 100MB again and was going to dismount the store again, but took a look at the queue and saw something I missed before.

There is a "SmallBusiness SMTP connector - <domainname.com> (SMTP connector) that had around 15 total messages and 62,000 total message size.

I purged those messages with no ndr and the growth seems to have stopped. I also froze this connector.

Any idea what this means? Some way I can look further into this?
0
 
Alan HardistyCommented:
Without seeing the sender / recipient names it is difficult to advise.  Did you happen to take a look at the messages and see who they were sent from / to?
0
 
tvaccAuthor Commented:
They were sent all from one person to a domain that is spelled incorrectly. I already deleted them, so I can't go back to take a look.
0
 
Alan HardistyCommented:
Was the person an internal user?

Are you on any blacklists at the moment?

www.mxtoolbox.com/blacklists.aspx or www.blacklistalert.org
0
 
tvaccAuthor Commented:
Yes, internal user. Not listed on any blacklists.
0
 
tvaccAuthor Commented:
Also, the POP3 service has always been disabled.
0
 
tvaccAuthor Commented:
I am going to do a backup of the exchange information store, then do an offline defrag to try to regain some space.

If anyone has any ideas, please let me know in the meantime.
0
 
Alan HardistyCommented:
I'm scratching my head here.  I can't see an internal user sending a message to an invalid external recipient causing your mail-store to grow quickly.

Can you look at the mailboxes in your store and monitor the item count to see if any particular mailbox is growing dramatically.
0
 
Alan HardistyCommented:
An offline defrag will only reclaim the amount of space identified by Event ID 1221 in the Application Event Log.  Without setting the mailbox / mailstore retention period to 0 for both and then restarting the Information Store, then offline defrag will not reclaim much space.  Once you have lowered the retention periods and restarted the store, you will reclaim ALL the white space in the store, but you will need 110% of the total store size in available free space on a drive somewhere.

So, if you store is 50Gb (.EDB + .STM files), you will need 55Gb in free space on your server to run the defrag.
0
 
rjpilcherCommented:
And as mentioned before, you can do a defrag to any drive letter on the server (mapped drive, USB) - it will just be slower.

It may be that your user has a virus and is spamming - something to look into.
0
 
tvaccAuthor Commented:
Thanks guys. I am doing a backup now and will resonsider the defrag based on the amount of white space available.
0
 
tvaccAuthor Commented:
The solution was to freeze the queue that had the bad messages in it. I'm not sure how sending out bad messages could make the information store grow so quickly, but stopping them resolved the problem.
0

Featured Post

Problems using Powershell and Active Directory?

Managing Active Directory does not always have to be complicated.  If you are spending more time trying instead of doing, then it's time to look at something else. For nearly 20 years, AD admins around the world have used one tool for day-to-day AD management: Hyena. Discover why

  • 9
  • 5
  • 2
Tackle projects and never again get stuck behind a technical roadblock.
Join Now