tvacc
asked on
Exchange 2003 mailbox store growing at fast rate
I have a SBS 2003 Box (exchange 2003) that all of a sudden ran out of space early this morning and brought everything to a halt. I freed up all the space I could on the partition, around 1-2GB, but later in the day the free space was gone again.
I took a closer look and found that the mailbox store (priv1.edb) was growing by a MB or so every second. I dismounted the mailbox store and ran isinteg.exe /s <server> -fix /t d: -test ALLTESTS. It ran through 21 tests and only made two "fixes" during the "folders" test.
I mounted the database and found that the rate at which the database is growing has slowed, but is still completely unacceptable. I have run though 400MB in less than 4 hours and I have once again dismounted the database.
Where do I go from here? I was going to run an offline defrag on the mailbox store, but I have no space left on the drive. If this is the next move, how do I go about defragging without any disk space?
I took a closer look and found that the mailbox store (priv1.edb) was growing by a MB or so every second. I dismounted the mailbox store and ran isinteg.exe /s <server> -fix /t d: -test ALLTESTS. It ran through 21 tests and only made two "fixes" during the "folders" test.
I mounted the database and found that the rate at which the database is growing has slowed, but is still completely unacceptable. I have run though 400MB in less than 4 hours and I have once again dismounted the database.
Where do I go from here? I was going to run an offline defrag on the mailbox store, but I have no space left on the drive. If this is the next move, how do I go about defragging without any disk space?
ASKER CERTIFIED SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
ASKER
Also, how can I tell if the growth is caused by mail coming in repeatedly?
SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
ASKER
I think I may have some more useful information. I am down to 100MB again and was going to dismount the store again, but took a look at the queue and saw something I missed before.
There is a "SmallBusiness SMTP connector - <domainname.com> (SMTP connector) that had around 15 total messages and 62,000 total message size.
I purged those messages with no ndr and the growth seems to have stopped. I also froze this connector.
Any idea what this means? Some way I can look further into this?
There is a "SmallBusiness SMTP connector - <domainname.com> (SMTP connector) that had around 15 total messages and 62,000 total message size.
I purged those messages with no ndr and the growth seems to have stopped. I also froze this connector.
Any idea what this means? Some way I can look further into this?
Without seeing the sender / recipient names it is difficult to advise. Did you happen to take a look at the messages and see who they were sent from / to?
SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Was the person an internal user?
Are you on any blacklists at the moment?
www.mxtoolbox.com/blacklists.aspx or www.blacklistalert.org
Are you on any blacklists at the moment?
www.mxtoolbox.com/blacklists.aspx or www.blacklistalert.org
ASKER
Yes, internal user. Not listed on any blacklists.
ASKER
Also, the POP3 service has always been disabled.
ASKER
I am going to do a backup of the exchange information store, then do an offline defrag to try to regain some space.
If anyone has any ideas, please let me know in the meantime.
If anyone has any ideas, please let me know in the meantime.
I'm scratching my head here. I can't see an internal user sending a message to an invalid external recipient causing your mail-store to grow quickly.
Can you look at the mailboxes in your store and monitor the item count to see if any particular mailbox is growing dramatically.
Can you look at the mailboxes in your store and monitor the item count to see if any particular mailbox is growing dramatically.
An offline defrag will only reclaim the amount of space identified by Event ID 1221 in the Application Event Log. Without setting the mailbox / mailstore retention period to 0 for both and then restarting the Information Store, then offline defrag will not reclaim much space. Once you have lowered the retention periods and restarted the store, you will reclaim ALL the white space in the store, but you will need 110% of the total store size in available free space on a drive somewhere.
So, if you store is 50Gb (.EDB + .STM files), you will need 55Gb in free space on your server to run the defrag.
So, if you store is 50Gb (.EDB + .STM files), you will need 55Gb in free space on your server to run the defrag.
And as mentioned before, you can do a defrag to any drive letter on the server (mapped drive, USB) - it will just be slower.
It may be that your user has a virus and is spamming - something to look into.
It may be that your user has a virus and is spamming - something to look into.
ASKER
Thanks guys. I am doing a backup now and will resonsider the defrag based on the amount of white space available.
ASKER
The solution was to freeze the queue that had the bad messages in it. I'm not sure how sending out bad messages could make the information store grow so quickly, but stopping them resolved the problem.
ASKER