Solved

URGENT - SBS 2011 not receiving email

Posted on 2011-09-12
28
2,478 Views
Last Modified: 2012-05-12
I have  customer with a SBS 2011 (Excahnge 2010) not receiving emails. It was working fine until a few hours ago. The ISP is Bell Canada and I can telnet in to port 25.

The MX records have not change but it seems like the email are not going to priority 0. The emails are not bouncing back to the sender either.

Any ideas what to look for? mx records
0
Comment
Question by:Gerhardpet
  • 10
  • 7
  • 5
  • +2
28 Comments
 
LVL 1

Author Comment

by:Gerhardpet
ID: 36523899
Ok I just found that I only have 3.3 GB free on C drive of 195 GB

Why would that be?
0
 
LVL 14

Expert Comment

by:setasoujiro
ID: 36523900
your server is out of resources
i just tried to telnet into your machine and it says out of resources
0
 
LVL 14

Expert Comment

by:setasoujiro
ID: 36523911
you probably never backup your server up ?
i suspect you have about 100GB of exchange trasport logs

and also you should not post your info online (not everyone is trying to help u you know)
0
 
LVL 27

Expert Comment

by:davorin
ID: 36523933
With SMTP test on www.mxtoolbox.com I get 452 4.3.1 Insufficient system resources error
Do you have exchange database and logs on c disk?
Try to move some less important files to another location (like pictures) to free space on drive c.
0
 
LVL 1

Author Comment

by:Gerhardpet
ID: 36523962
Yes the server backup is running every night with the build in backup in SBS 2011

The exchange store is on the D: drive with 1.57 TB free of 1.70 TB
0
 
LVL 27

Expert Comment

by:davorin
ID: 36523980
Then you can start diagnosing what is occupying so much space.
I would start at exchange DB and logs folder.

Running SBS 2011 BPA and exchange 2010 BPA can help you to put in right direction.
0
 
LVL 29

Expert Comment

by:Randy Downs
ID: 36523982
Strange that it would stop working. New certificate or expire certificate?

Internal email working?

Maybe this will help

http://mobile.experts-exchange.com/Q_27035260.html

Did you run the Internet Address Wizard? This sets up several components for Exchange and would easily explain the "service not available" error if it was not run as your connectors are not fully tied into the transport serviee yet.
0
 
LVL 1

Author Comment

by:Gerhardpet
ID: 36523993
all of the user files and exchange are on the d: drive with lots of free space

I have nothing else but the defaulted installed programs on c drive

When I right click on each forlder on C drive to check for size none of them are taking up more then 20 gigs that being the Windows folder. There is just simply nothing on C drive that would take up that much space
0
 
LVL 1

Author Comment

by:Gerhardpet
ID: 36524023
Yes internal emails are working. Sending emails is working too
0
 
LVL 27

Expert Comment

by:davorin
ID: 36524032
Try to enable show system and hidden files before checking folder sizes.

Sometimes sharepoint logs can grow to huge size - but this will show BPA.
0
 
LVL 29

Expert Comment

by:Randy Downs
ID: 36524076
You could try something like this to see free space

http://windirstat.info/
0
 
LVL 1

Author Comment

by:Gerhardpet
ID: 36524115
There is on hidden folder on C drive called programdata with 45Mb in it

From when I posted this question the C drive now has 2.8GB free space. It keeps on growing
0
 
LVL 29

Expert Comment

by:Randy Downs
ID: 36524187
I don't see any records for remote.featurefoods.ca

a:remote.featurefoods.ca     a    

Type Domain Name IP Address TTL
A remote.featurefoods.ca 74.15.167.242 60 min
dns lookup ns lookup mx lookup whois lookup

Reported by ns71.domaincontrol.com on Monday, September 12, 2011 at 11:59:21 AM (GMT-5)



mx:remote.featurefoods.ca     mx    

No records founddns lookup ns lookup mx lookup whois lookup

Reported by ns71.domaincontrol.com on Monday, September 12, 2011 at 11:59:03 AM (GMT-5)
0
 
LVL 1

Author Comment

by:Gerhardpet
ID: 36524215
Windows explorer reports that I have 2.8 free of 197GB but when I run TreeSize I get the following

Ofcourse there are records for the domain

 treesize
0
Top 6 Sources for Identifying Threat Actor TTPs

Understanding your enemy is essential. These six sources will help you identify the most popular threat actor tactics, techniques, and procedures (TTPs).

 
LVL 27

Expert Comment

by:davorin
ID: 36524271
Have you run Treesize "run as administrator"?
0
 
LVL 27

Expert Comment

by:davorin
ID: 36524312
Look at this link:
http://simultaneouspancakes.com/Lessons/2010/01/13/recovering-hidden-disk-space-used-on-sbs-2008-c-partitions/
WSUS site in IIS logs took lots of space - in that case path was C:\inetpub\logs\LogFiles\W3SVC1372222313
It is for SBS 2008, but it is worth to look.
 
0
 
LVL 8

Expert Comment

by:ActiveDirectoryman
ID: 36524498


Your server is in backpressure mode. it is a protective measure to prevent damage to your exchange server.   your server can  get into backpressure mode due to limited system resources such as low hard disk space, memory, etc.  If you are seeing messages such as  insufficient system resources then it is because exchange it is in backpressure mode.  You need at least 4GB or more on your C drive for mail queues to function correctly. free up more space and restart your server.  Also check the event viewer logs for more backpressure symptoms.
0
 
LVL 8

Expert Comment

by:ActiveDirectoryman
ID: 36524510

understanding backpressure

exchange 2010
http://technet.microsoft.com/en-us/library/bb201658.aspx
0
 
LVL 27

Expert Comment

by:davorin
ID: 36524579
It seems that (at least momentary) you have solved the problem.
Just another think - you should ask your ISP to correct the RDNS setting to the A record of your mail server.
0
 
LVL 1

Author Comment

by:Gerhardpet
ID: 36524791
I have not done anything and now I have 10.3Gigs free. Mail is flowing again but I need to find what is causing the problem

I have already restarted the server and that has not helped
0
 
LVL 8

Expert Comment

by:ActiveDirectoryman
ID: 36524892


Again,  exchange was in backpressure mode.  Backpressure is a exchange 2010 system resource monitoring feature.  Low hard disk space is one of items it monitors.  All the information you need is in the article.  It is critical that you understand backpressure and how to resolve it because it can be caused by number of things.  
0
 
LVL 27

Expert Comment

by:davorin
ID: 36524934
185GB used only for system files if far too much. SBS 2011 should use max 80GB for that.
We need here a more systematic approach.

ActiveDirectoryman is right about back pressure mode, but this is only the symptom, not the cause of low disk space on drive C:.
The main problem is, that you cannot see the correct size of the folders.
And there were a number of suggestions in previous posts and we need to know what have you already done.
 
0
 
LVL 14

Expert Comment

by:setasoujiro
ID: 36525274
could it be that you have WSUS running on the SBS?
and that there are a lot of updates building up?
0
 
LVL 1

Author Comment

by:Gerhardpet
ID: 36527081
WSUS is configured but the WSUS folder is only 1.46 GB

So far I have not found the problem. Found the following sharepoint errors in the events
 
Log Name:      Application
Source:        Microsoft-SharePoint Products-SharePoint Foundation Search
Date:          12/09/2011 10:29:33 PM
Event ID:      67
Task Category: Gatherer
Level:         Error
Keywords:      
User:          FFI\spsearch
Computer:      FFISERVER.ffi.local
Description:
Could not access the Search database. A generic error occurred while trying to access the database to obtain the schema version info.

Context: Application '7a98b58d-8816-4e1b-9f0e-3b6bb8974b8d'

Details:
	Unspecified error
 (0x80004005)
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-SharePoint Products-SharePoint Foundation Search" Guid="{1C415899-58B3-4BFC-9236-105E7FD38719}" />
    <EventID>67</EventID>
    <Version>14</Version>
    <Level>2</Level>
    <Task>174</Task>
    <Opcode>0</Opcode>
    <Keywords>0x2000000000000000</Keywords>
    <TimeCreated SystemTime="2011-09-13T02:29:33.836562200Z" />
    <EventRecordID>230788</EventRecordID>
    <Correlation />
    <Execution ProcessID="5020" ThreadID="4120" />
    <Channel>Application</Channel>
    <Computer>FFISERVER.ffi.local</Computer>
    <Security UserID="S-1-5-21-1832440195-4197322899-259064081-1161" />
  </System>
  <EventData>
    <Data Name="string0">

Context: Application '7a98b58d-8816-4e1b-9f0e-3b6bb8974b8d'

Details:
	Unspecified error
 (0x80004005)</Data>
  </EventData>
</Event>

Open in new window

Log Name:      Application
Source:        VSS
Date:          12/09/2011 10:23:03 PM
Event ID:      8230
Task Category: None
Level:         Warning
Keywords:      Classic
User:          N/A
Computer:      FFISERVER.ffi.local
Description:
Volume Shadow Copy Service error: Failed resolving account spsearch with status 1376. Check connection to domain controller and VssAccessControl registry key. 

Operation:
   Initializing Writer

Context:
   Writer Class Id: {b2014c9e-8711-4c5c-a5a9-3cf384484757}
   Writer Name: NTDS

Error-specific details:
   Error: NetLocalGroupGetMemebers(spsearch), 0x80070560, The specified local group does not exist.

Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="VSS" />
    <EventID Qualifiers="0">8230</EventID>
    <Level>3</Level>
    <Task>0</Task>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2011-09-13T02:23:03.000000000Z" />
    <EventRecordID>230244</EventRecordID>
    <Channel>Application</Channel>
    <Computer>FFISERVER.ffi.local</Computer>
    <Security />
  </System>
  <EventData>
    <Data>spsearch</Data>
    <Data>1376</Data>
    <Data>

Operation:
   Initializing Writer

Context:
   Writer Class Id: {b2014c9e-8711-4c5c-a5a9-3cf384484757}
   Writer Name: NTDS

Error-specific details:
   Error: NetLocalGroupGetMemebers(spsearch), 0x80070560, The specified local group does not exist.
</Data>

Open in new window

Log Name:      Application
Source:        Microsoft-SharePoint Products-SharePoint Foundation
Date:          12/09/2011 10:00:03 PM
Event ID:      2137
Task Category: Health
Level:         Error
Keywords:      
User:          FFI\spfarm
Computer:      FFISERVER.ffi.local
Description:
The SharePoint Health Analyzer detected an error.  Drives are running out of free space.
Available drive space is less than twice the value of physical memory. This is dangerous because it does not provide enough room for a full memory dump with continued operation. It also could cause problems with the Virtual Memory swap file:  (FFISERVER - C:\).
Examine the failing servers and delete old logs or free space on the drives. For more information about this rule, see "http://go.microsoft.com/fwlink/?LinkID=142688".

Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-SharePoint Products-SharePoint Foundation" Guid="{6FB7E0CD-52E7-47DD-997A-241563931FC2}" />
    <EventID>2137</EventID>
    <Version>14</Version>
    <Level>2</Level>
    <Task>8</Task>
    <Opcode>0</Opcode>
    <Keywords>0x4000000000000000</Keywords>
    <TimeCreated SystemTime="2011-09-13T02:00:03.353535500Z" />
    <EventRecordID>230188</EventRecordID>
    <Correlation ActivityID="{00BF2E8D-B84B-4918-84B9-F497576740EE}" />
    <Execution ProcessID="2292" ThreadID="5932" />
    <Channel>Application</Channel>
    <Computer>FFISERVER.ffi.local</Computer>
    <Security UserID="S-1-5-21-1832440195-4197322899-259064081-1157" />
  </System>
  <EventData>
    <Data Name="string0">Drives are running out of free space.
Available drive space is less than twice the value of physical memory. This is dangerous because it does not provide enough room for a full memory dump with continued operation. It also could cause problems with the Virtual Memory swap file:  (FFISERVER - C:\).
Examine the failing servers and delete old logs or free space on the drives. For more information about this rule, see "http://go.microsoft.com/fwlink/?LinkID=142688".
</Data>
  </EventData>
</Event>

Open in new window

0
 
LVL 1

Author Comment

by:Gerhardpet
ID: 36529142
Now I know where the space is being used

I did run this command "vssadmin list shadowstorage"

Here are the results I get and that is where the space sucking is.

Used Shadow Copy Storage space: 135.98 GB (69%)
Allocated Shadow Copy Storage space: 138.602 GB (70%)
Maximum Shadow Copy Storage space: 186.19 GB (95%)

and
 
C:\>Dir /ah
 Volume in drive C has no label.
 Volume Serial Number is 204C-04A1

 Directory of C:\

14/07/2011  10:20 AM    <DIR>          $Recycle.Bin
14/07/2009  01:06 AM    <JUNCTION>     Documents and Settings [C:\Users]
12/09/2011  10:28 PM    17,166,327,808 pagefile.sys
10/05/2011  04:55 PM    <DIR>          ProgramData
30/04/2011  10:50 AM    <DIR>          Recovery
13/09/2011  07:00 AM    <DIR>          System Volume Information
               1 File(s) 17,166,327,808 bytes
               5 Dir(s)   8,630,370,304 bytes free

Open in new window


How do I fix this?
0
 
LVL 14

Accepted Solution

by:
setasoujiro earned 500 total points
ID: 36529220
0
 
LVL 1

Author Closing Comment

by:Gerhardpet
ID: 36529253
Thank you! I have not disabled shadow copy for C:

I have the space back to normal
0
 
LVL 14

Expert Comment

by:setasoujiro
ID: 36529258
No problem! just make sure to setup a storage limit for VSS
0

Featured Post

Shouldn't all users have the same email signature?

You wouldn't let your users design their own business cards, would you? So, why do you let them design their own email signatures? Think of the damage they could be doing to your brand reputation! Choose the easy way to manage set up and add email signatures for all users.

Join & Write a Comment

Resolve DNS query failed errors for Exchange
This process describes the steps required to Import and Export data from and to .pst files using Exchange 2010. We can use these steps to export data from a user to a .pst file, import data back to the same or a different user, or even import data t…
In this video we show how to create a User Mailbox in Exchange 2013. We show this process by using the Exchange Admin Center. Log into Exchange Admin Center.: First we need to log into the Exchange Admin Center. Navigate to the Recipients >> Mailb…
In this video we show how to create a Resource Mailbox in Exchange 2013. We show this process by using the Exchange Admin Center. Log into Exchange Admin Center.: Navigate to the Recipients >> Resources tab.: "Recipients" is our default selection …

744 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

11 Experts available now in Live!

Get 1:1 Help Now