Link to home
Start Free TrialLog in
Avatar of Gerhardpet
GerhardpetFlag for Canada

asked on

URGENT - SBS 2011 not receiving email

I have  customer with a SBS 2011 (Excahnge 2010) not receiving emails. It was working fine until a few hours ago. The ISP is Bell Canada and I can telnet in to port 25.

The MX records have not change but it seems like the email are not going to priority 0. The emails are not bouncing back to the sender either.

Any ideas what to look for? User generated image
Avatar of Gerhardpet
Gerhardpet
Flag of Canada image

ASKER

Ok I just found that I only have 3.3 GB free on C drive of 195 GB

Why would that be?
your server is out of resources
i just tried to telnet into your machine and it says out of resources
you probably never backup your server up ?
i suspect you have about 100GB of exchange trasport logs

and also you should not post your info online (not everyone is trying to help u you know)
Avatar of davorin
With SMTP test on www.mxtoolbox.com I get 452 4.3.1 Insufficient system resources error
Do you have exchange database and logs on c disk?
Try to move some less important files to another location (like pictures) to free space on drive c.
Yes the server backup is running every night with the build in backup in SBS 2011

The exchange store is on the D: drive with 1.57 TB free of 1.70 TB
Then you can start diagnosing what is occupying so much space.
I would start at exchange DB and logs folder.

Running SBS 2011 BPA and exchange 2010 BPA can help you to put in right direction.
Strange that it would stop working. New certificate or expire certificate?

Internal email working?

Maybe this will help

http://mobile.experts-exchange.com/questions/27035260/SBS-2011-Email-not-receiving.html

Did you run the Internet Address Wizard? This sets up several components for Exchange and would easily explain the "service not available" error if it was not run as your connectors are not fully tied into the transport serviee yet.
all of the user files and exchange are on the d: drive with lots of free space

I have nothing else but the defaulted installed programs on c drive

When I right click on each forlder on C drive to check for size none of them are taking up more then 20 gigs that being the Windows folder. There is just simply nothing on C drive that would take up that much space
Yes internal emails are working. Sending emails is working too
Try to enable show system and hidden files before checking folder sizes.

Sometimes sharepoint logs can grow to huge size - but this will show BPA.
You could try something like this to see free space

http://windirstat.info/
There is on hidden folder on C drive called programdata with 45Mb in it

From when I posted this question the C drive now has 2.8GB free space. It keeps on growing
I don't see any records for remote.featurefoods.ca

a:remote.featurefoods.ca     a    

Type Domain Name IP Address TTL
A remote.featurefoods.ca 74.15.167.242 60 min
dns lookup ns lookup mx lookup whois lookup

Reported by ns71.domaincontrol.com on Monday, September 12, 2011 at 11:59:21 AM (GMT-5)



mx:remote.featurefoods.ca     mx    

No records founddns lookup ns lookup mx lookup whois lookup

Reported by ns71.domaincontrol.com on Monday, September 12, 2011 at 11:59:03 AM (GMT-5)
Windows explorer reports that I have 2.8 free of 197GB but when I run TreeSize I get the following

Ofcourse there are records for the domain

 User generated image
Have you run Treesize "run as administrator"?
Look at this link:
http://simultaneouspancakes.com/Lessons/2010/01/13/recovering-hidden-disk-space-used-on-sbs-2008-c-partitions/
WSUS site in IIS logs took lots of space - in that case path was C:\inetpub\logs\LogFiles\W3SVC1372222313
It is for SBS 2008, but it is worth to look.
 
Avatar of ActiveDirectoryman
ActiveDirectoryman



Your server is in backpressure mode. it is a protective measure to prevent damage to your exchange server.   your server can  get into backpressure mode due to limited system resources such as low hard disk space, memory, etc.  If you are seeing messages such as  insufficient system resources then it is because exchange it is in backpressure mode.  You need at least 4GB or more on your C drive for mail queues to function correctly. free up more space and restart your server.  Also check the event viewer logs for more backpressure symptoms.
It seems that (at least momentary) you have solved the problem.
Just another think - you should ask your ISP to correct the RDNS setting to the A record of your mail server.
I have not done anything and now I have 10.3Gigs free. Mail is flowing again but I need to find what is causing the problem

I have already restarted the server and that has not helped


Again,  exchange was in backpressure mode.  Backpressure is a exchange 2010 system resource monitoring feature.  Low hard disk space is one of items it monitors.  All the information you need is in the article.  It is critical that you understand backpressure and how to resolve it because it can be caused by number of things.  
185GB used only for system files if far too much. SBS 2011 should use max 80GB for that.
We need here a more systematic approach.

ActiveDirectoryman is right about back pressure mode, but this is only the symptom, not the cause of low disk space on drive C:.
The main problem is, that you cannot see the correct size of the folders.
And there were a number of suggestions in previous posts and we need to know what have you already done.
 
could it be that you have WSUS running on the SBS?
and that there are a lot of updates building up?
WSUS is configured but the WSUS folder is only 1.46 GB

So far I have not found the problem. Found the following sharepoint errors in the events
 
Log Name:      Application
Source:        Microsoft-SharePoint Products-SharePoint Foundation Search
Date:          12/09/2011 10:29:33 PM
Event ID:      67
Task Category: Gatherer
Level:         Error
Keywords:      
User:          FFI\spsearch
Computer:      FFISERVER.ffi.local
Description:
Could not access the Search database. A generic error occurred while trying to access the database to obtain the schema version info.

Context: Application '7a98b58d-8816-4e1b-9f0e-3b6bb8974b8d'

Details:
	Unspecified error
 (0x80004005)
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-SharePoint Products-SharePoint Foundation Search" Guid="{1C415899-58B3-4BFC-9236-105E7FD38719}" />
    <EventID>67</EventID>
    <Version>14</Version>
    <Level>2</Level>
    <Task>174</Task>
    <Opcode>0</Opcode>
    <Keywords>0x2000000000000000</Keywords>
    <TimeCreated SystemTime="2011-09-13T02:29:33.836562200Z" />
    <EventRecordID>230788</EventRecordID>
    <Correlation />
    <Execution ProcessID="5020" ThreadID="4120" />
    <Channel>Application</Channel>
    <Computer>FFISERVER.ffi.local</Computer>
    <Security UserID="S-1-5-21-1832440195-4197322899-259064081-1161" />
  </System>
  <EventData>
    <Data Name="string0">

Context: Application '7a98b58d-8816-4e1b-9f0e-3b6bb8974b8d'

Details:
	Unspecified error
 (0x80004005)</Data>
  </EventData>
</Event>

Open in new window

Log Name:      Application
Source:        VSS
Date:          12/09/2011 10:23:03 PM
Event ID:      8230
Task Category: None
Level:         Warning
Keywords:      Classic
User:          N/A
Computer:      FFISERVER.ffi.local
Description:
Volume Shadow Copy Service error: Failed resolving account spsearch with status 1376. Check connection to domain controller and VssAccessControl registry key. 

Operation:
   Initializing Writer

Context:
   Writer Class Id: {b2014c9e-8711-4c5c-a5a9-3cf384484757}
   Writer Name: NTDS

Error-specific details:
   Error: NetLocalGroupGetMemebers(spsearch), 0x80070560, The specified local group does not exist.

Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="VSS" />
    <EventID Qualifiers="0">8230</EventID>
    <Level>3</Level>
    <Task>0</Task>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2011-09-13T02:23:03.000000000Z" />
    <EventRecordID>230244</EventRecordID>
    <Channel>Application</Channel>
    <Computer>FFISERVER.ffi.local</Computer>
    <Security />
  </System>
  <EventData>
    <Data>spsearch</Data>
    <Data>1376</Data>
    <Data>

Operation:
   Initializing Writer

Context:
   Writer Class Id: {b2014c9e-8711-4c5c-a5a9-3cf384484757}
   Writer Name: NTDS

Error-specific details:
   Error: NetLocalGroupGetMemebers(spsearch), 0x80070560, The specified local group does not exist.
</Data>

Open in new window

Log Name:      Application
Source:        Microsoft-SharePoint Products-SharePoint Foundation
Date:          12/09/2011 10:00:03 PM
Event ID:      2137
Task Category: Health
Level:         Error
Keywords:      
User:          FFI\spfarm
Computer:      FFISERVER.ffi.local
Description:
The SharePoint Health Analyzer detected an error.  Drives are running out of free space.
Available drive space is less than twice the value of physical memory. This is dangerous because it does not provide enough room for a full memory dump with continued operation. It also could cause problems with the Virtual Memory swap file:  (FFISERVER - C:\).
Examine the failing servers and delete old logs or free space on the drives. For more information about this rule, see "http://go.microsoft.com/fwlink/?LinkID=142688".

Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-SharePoint Products-SharePoint Foundation" Guid="{6FB7E0CD-52E7-47DD-997A-241563931FC2}" />
    <EventID>2137</EventID>
    <Version>14</Version>
    <Level>2</Level>
    <Task>8</Task>
    <Opcode>0</Opcode>
    <Keywords>0x4000000000000000</Keywords>
    <TimeCreated SystemTime="2011-09-13T02:00:03.353535500Z" />
    <EventRecordID>230188</EventRecordID>
    <Correlation ActivityID="{00BF2E8D-B84B-4918-84B9-F497576740EE}" />
    <Execution ProcessID="2292" ThreadID="5932" />
    <Channel>Application</Channel>
    <Computer>FFISERVER.ffi.local</Computer>
    <Security UserID="S-1-5-21-1832440195-4197322899-259064081-1157" />
  </System>
  <EventData>
    <Data Name="string0">Drives are running out of free space.
Available drive space is less than twice the value of physical memory. This is dangerous because it does not provide enough room for a full memory dump with continued operation. It also could cause problems with the Virtual Memory swap file:  (FFISERVER - C:\).
Examine the failing servers and delete old logs or free space on the drives. For more information about this rule, see "http://go.microsoft.com/fwlink/?LinkID=142688".
</Data>
  </EventData>
</Event>

Open in new window

Now I know where the space is being used

I did run this command "vssadmin list shadowstorage"

Here are the results I get and that is where the space sucking is.

Used Shadow Copy Storage space: 135.98 GB (69%)
Allocated Shadow Copy Storage space: 138.602 GB (70%)
Maximum Shadow Copy Storage space: 186.19 GB (95%)

and
 
C:\>Dir /ah
 Volume in drive C has no label.
 Volume Serial Number is 204C-04A1

 Directory of C:\

14/07/2011  10:20 AM    <DIR>          $Recycle.Bin
14/07/2009  01:06 AM    <JUNCTION>     Documents and Settings [C:\Users]
12/09/2011  10:28 PM    17,166,327,808 pagefile.sys
10/05/2011  04:55 PM    <DIR>          ProgramData
30/04/2011  10:50 AM    <DIR>          Recovery
13/09/2011  07:00 AM    <DIR>          System Volume Information
               1 File(s) 17,166,327,808 bytes
               5 Dir(s)   8,630,370,304 bytes free

Open in new window


How do I fix this?
ASKER CERTIFIED SOLUTION
Avatar of setasoujiro
setasoujiro
Flag of Belgium image

Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial
Thank you! I have not disabled shadow copy for C:

I have the space back to normal
No problem! just make sure to setup a storage limit for VSS