• Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 991
  • Last Modified:

Exchange 2003 mailbox store growing at fast rate

I have a SBS 2003 Box (exchange 2003) that all of a sudden ran out of space early this morning and brought everything to a halt. I freed up all the space I could on the partition, around 1-2GB, but later in the day the free space was gone again.

I took a closer look and found that the mailbox store (priv1.edb) was growing by a MB or so every second. I dismounted the mailbox store and ran isinteg.exe /s <server> -fix /t d: -test ALLTESTS. It ran through 21 tests and only made two "fixes" during the "folders" test.

I mounted the database and found that the rate at which the database is growing has slowed, but is still completely unacceptable. I have run though 400MB in less than 4 hours and I have once again dismounted the database.

Where do I go from here? I was going to run an offline defrag on the mailbox store, but I have no space left on the drive. If this is the next move, how do I go about defragging without any disk space?
0
tvacc
Asked:
tvacc
  • 9
  • 5
  • 2
3 Solutions
 
tvaccAuthor Commented:
I should specify: is there a way to go about specifying another drive/partition to store the data during the defrag like there is with isinteg?
0
 
rjpilcherCommented:
You can do an offline defrag to a mapped drive or even a USB drive

eseutil /d <database path> /t<drivepath\temp.edb>

Also, you might want to see if you can take a look at the mailflow, or identify any mailboxes that may be growing - you could have a mail loop occurring.
0
 
tvaccAuthor Commented:
Also, how can I tell if the growth is caused by mail coming in repeatedly?
0
Problems using Powershell and Active Directory?

Managing Active Directory does not always have to be complicated.  If you are spending more time trying instead of doing, then it's time to look at something else. For nearly 20 years, AD admins around the world have used one tool for day-to-day AD management: Hyena. Discover why

 
Alan HardistyCo-OwnerCommented:
Disable the POP3 service - it should prevent any POP3 downloading to Exchange which will cause a mail-loop as described above.

Then see if the store stops growing madly - if it does - you then need to find the client that has configured POP3 to pull mail and deliver it to Exchange!
0
 
tvaccAuthor Commented:
I think I may have some more useful information. I am down to 100MB again and was going to dismount the store again, but took a look at the queue and saw something I missed before.

There is a "SmallBusiness SMTP connector - <domainname.com> (SMTP connector) that had around 15 total messages and 62,000 total message size.

I purged those messages with no ndr and the growth seems to have stopped. I also froze this connector.

Any idea what this means? Some way I can look further into this?
0
 
Alan HardistyCo-OwnerCommented:
Without seeing the sender / recipient names it is difficult to advise.  Did you happen to take a look at the messages and see who they were sent from / to?
0
 
tvaccAuthor Commented:
They were sent all from one person to a domain that is spelled incorrectly. I already deleted them, so I can't go back to take a look.
0
 
Alan HardistyCo-OwnerCommented:
Was the person an internal user?

Are you on any blacklists at the moment?

www.mxtoolbox.com/blacklists.aspx or www.blacklistalert.org
0
 
tvaccAuthor Commented:
Yes, internal user. Not listed on any blacklists.
0
 
tvaccAuthor Commented:
Also, the POP3 service has always been disabled.
0
 
tvaccAuthor Commented:
I am going to do a backup of the exchange information store, then do an offline defrag to try to regain some space.

If anyone has any ideas, please let me know in the meantime.
0
 
Alan HardistyCo-OwnerCommented:
I'm scratching my head here.  I can't see an internal user sending a message to an invalid external recipient causing your mail-store to grow quickly.

Can you look at the mailboxes in your store and monitor the item count to see if any particular mailbox is growing dramatically.
0
 
Alan HardistyCo-OwnerCommented:
An offline defrag will only reclaim the amount of space identified by Event ID 1221 in the Application Event Log.  Without setting the mailbox / mailstore retention period to 0 for both and then restarting the Information Store, then offline defrag will not reclaim much space.  Once you have lowered the retention periods and restarted the store, you will reclaim ALL the white space in the store, but you will need 110% of the total store size in available free space on a drive somewhere.

So, if you store is 50Gb (.EDB + .STM files), you will need 55Gb in free space on your server to run the defrag.
0
 
rjpilcherCommented:
And as mentioned before, you can do a defrag to any drive letter on the server (mapped drive, USB) - it will just be slower.

It may be that your user has a virus and is spamming - something to look into.
0
 
tvaccAuthor Commented:
Thanks guys. I am doing a backup now and will resonsider the defrag based on the amount of white space available.
0
 
tvaccAuthor Commented:
The solution was to freeze the queue that had the bad messages in it. I'm not sure how sending out bad messages could make the information store grow so quickly, but stopping them resolved the problem.
0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

Join & Write a Comment

Featured Post

Free Tool: Path Explorer

An intuitive utility to help find the CSS path to UI elements on a webpage. These paths are used frequently in a variety of front-end development and QA automation tasks.

One of a set of tools we're offering as a way of saying thank you for being a part of the community.

  • 9
  • 5
  • 2
Tackle projects and never again get stuck behind a technical roadblock.
Join Now