Solved

Exchange 2003 mailbox store growing at fast rate

Posted on 2011-03-18
16
980 Views
Last Modified: 2013-11-05
I have a SBS 2003 Box (exchange 2003) that all of a sudden ran out of space early this morning and brought everything to a halt. I freed up all the space I could on the partition, around 1-2GB, but later in the day the free space was gone again.

I took a closer look and found that the mailbox store (priv1.edb) was growing by a MB or so every second. I dismounted the mailbox store and ran isinteg.exe /s <server> -fix /t d: -test ALLTESTS. It ran through 21 tests and only made two "fixes" during the "folders" test.

I mounted the database and found that the rate at which the database is growing has slowed, but is still completely unacceptable. I have run though 400MB in less than 4 hours and I have once again dismounted the database.

Where do I go from here? I was going to run an offline defrag on the mailbox store, but I have no space left on the drive. If this is the next move, how do I go about defragging without any disk space?
0
Comment
Question by:tvacc
  • 9
  • 5
  • 2
16 Comments
 

Author Comment

by:tvacc
ID: 35169442
I should specify: is there a way to go about specifying another drive/partition to store the data during the defrag like there is with isinteg?
0
 
LVL 4

Accepted Solution

by:
rjpilcher earned 300 total points
ID: 35169462
You can do an offline defrag to a mapped drive or even a USB drive

eseutil /d <database path> /t<drivepath\temp.edb>

Also, you might want to see if you can take a look at the mailflow, or identify any mailboxes that may be growing - you could have a mail loop occurring.
0
 

Author Comment

by:tvacc
ID: 35169471
Also, how can I tell if the growth is caused by mail coming in repeatedly?
0
 
LVL 76

Assisted Solution

by:Alan Hardisty
Alan Hardisty earned 200 total points
ID: 35169481
Disable the POP3 service - it should prevent any POP3 downloading to Exchange which will cause a mail-loop as described above.

Then see if the store stops growing madly - if it does - you then need to find the client that has configured POP3 to pull mail and deliver it to Exchange!
0
 

Author Comment

by:tvacc
ID: 35169510
I think I may have some more useful information. I am down to 100MB again and was going to dismount the store again, but took a look at the queue and saw something I missed before.

There is a "SmallBusiness SMTP connector - <domainname.com> (SMTP connector) that had around 15 total messages and 62,000 total message size.

I purged those messages with no ndr and the growth seems to have stopped. I also froze this connector.

Any idea what this means? Some way I can look further into this?
0
 
LVL 76

Expert Comment

by:Alan Hardisty
ID: 35169518
Without seeing the sender / recipient names it is difficult to advise.  Did you happen to take a look at the messages and see who they were sent from / to?
0
 

Assisted Solution

by:tvacc
tvacc earned 0 total points
ID: 35169530
They were sent all from one person to a domain that is spelled incorrectly. I already deleted them, so I can't go back to take a look.
0
 
LVL 76

Expert Comment

by:Alan Hardisty
ID: 35169533
Was the person an internal user?

Are you on any blacklists at the moment?

www.mxtoolbox.com/blacklists.aspx or www.blacklistalert.org
0
How to run any project with ease

Manage projects of all sizes how you want. Great for personal to-do lists, project milestones, team priorities and launch plans.
- Combine task lists, docs, spreadsheets, and chat in one
- View and edit from mobile/offline
- Cut down on emails

 

Author Comment

by:tvacc
ID: 35169543
Yes, internal user. Not listed on any blacklists.
0
 

Author Comment

by:tvacc
ID: 35169556
Also, the POP3 service has always been disabled.
0
 

Author Comment

by:tvacc
ID: 35169564
I am going to do a backup of the exchange information store, then do an offline defrag to try to regain some space.

If anyone has any ideas, please let me know in the meantime.
0
 
LVL 76

Expert Comment

by:Alan Hardisty
ID: 35169574
I'm scratching my head here.  I can't see an internal user sending a message to an invalid external recipient causing your mail-store to grow quickly.

Can you look at the mailboxes in your store and monitor the item count to see if any particular mailbox is growing dramatically.
0
 
LVL 76

Expert Comment

by:Alan Hardisty
ID: 35169582
An offline defrag will only reclaim the amount of space identified by Event ID 1221 in the Application Event Log.  Without setting the mailbox / mailstore retention period to 0 for both and then restarting the Information Store, then offline defrag will not reclaim much space.  Once you have lowered the retention periods and restarted the store, you will reclaim ALL the white space in the store, but you will need 110% of the total store size in available free space on a drive somewhere.

So, if you store is 50Gb (.EDB + .STM files), you will need 55Gb in free space on your server to run the defrag.
0
 
LVL 4

Expert Comment

by:rjpilcher
ID: 35169592
And as mentioned before, you can do a defrag to any drive letter on the server (mapped drive, USB) - it will just be slower.

It may be that your user has a virus and is spamming - something to look into.
0
 

Author Comment

by:tvacc
ID: 35169609
Thanks guys. I am doing a backup now and will resonsider the defrag based on the amount of white space available.
0
 

Author Closing Comment

by:tvacc
ID: 35446449
The solution was to freeze the queue that had the bad messages in it. I'm not sure how sending out bad messages could make the information store grow so quickly, but stopping them resolved the problem.
0

Featured Post

How does your email signature look on mobiles?

Do your employees use mobile devices to reply to emails? With mobile becoming increasingly important to the business world, it is in your best interest to make sure that your email signature looks great across all types of devices.

Join & Write a Comment

Resolve Outlook connectivity issues after moving mailbox to new Exchange 2016 server
This article explains in simple steps how to renew expiring Exchange Server Internal Transport Certificate.
In this video we show how to create an email address policy in Exchange 2013. We show this process by using the Exchange Admin Center. Log into Exchange Admin Center.:  First we need to log into the Exchange Admin Center. Navigate to the Mail Flow…
In this video we show how to create a mailbox database in Exchange 2013. We show this process by using the Exchange Admin Center. Log into Exchange Admin Center.: First we need to log into the Exchange Admin Center. Navigate to the Servers >> Data…

708 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

15 Experts available now in Live!

Get 1:1 Help Now