We help IT Professionals succeed at work.

[Exchange 2010 SP1] Incoming E-mail Stuck in Queue

I have a SBS 2011 network with Exchange 2010 SP1. Some time (3 times in the last 6 months, but 2 times today) all the incoming e-mail is stuck in queue. I can send mail to outside, but all the incoming e-mail stuck in queue. I have checked the mail flow troubleshooter but i can't find any problems.

I have restarted the information store, but it doesn't help. Mail stuck in queue. Is there anyone here who can help me? It's a big problem at this moment.


At this moment, I have rebooted the server and it works now, but I am afraid for the next time...
Comment
Watch Question

Commented:
HAve you checked your transition logs?
Try turning onI turning Circular Logging (BTW this is NOT best practice)
but I've seen this happen when logs take up too much room.

Author

Commented:
No, I have not two Exchange Servers, only one.

And it works good for a couple of months and today, it give some problems.

Author

Commented:
I have checked my logfiles and it's 3,78 GB. Not so much I think...

Commented:
no thats not too big.  If a reboot fixed the problem, sounds like some service got stopped. CHeck your event viewer around the time emails stopped flowing...anything exchange related or serrvice related that could effect Exchange?

Author

Commented:
I see this messages in the event viewer:

1. (PID 19236, Thread 83) Task Get-Message throwing unhandled exception: System.Management.Automation.PipelineStoppedException: The pipeline has been stopped.
   at System.Management.Automation.MshCommandRuntime.ThrowIfStopping()
   at System.Management.Automation.MshCommandRuntime.WriteObject(Object sendToPipeline)
   at System.Management.Automation.Cmdlet.WriteObject(Object sendToPipeline)
   at Microsoft.Exchange.Management.QueueViewerTasks.RpcPagedGetObjectTask`1.InternalProcessRecord()
   at Microsoft.Exchange.Configuration.Tasks.Task.ProcessRecord().

After that:

2.

Cmdlet failed. Cmdlet Get-Message, parameters {IncludeBookmark=True, SortOrder={-FromAddress}, ReturnPageInfo=True, BookmarkObject=Microsoft.Exchange.Data.QueueViewer.PropertyBagBasedMessageInfo, Server=servername.domainname.local, ResultSize=1000, SearchForward=True, BookmarkIndex=-1, Filter=((Queue -eq 'servername\Submission'))}.

After that:

3.
Cmdlet failed. Cmdlet Get-Queue, parameters {ResultSize=1000, ReturnPageInfo=True, SortOrder={+NextHopDomain}, Server=servername.domainname.local, SearchForward=True, BookmarkObject=Microsoft.Exchange.Data.QueueViewer.PropertyBagBasedQueueInfo, BookmarkIndex=-1, IncludeBookmark=True}.

After that (2 times):

4.

Cmdlet failed. Cmdlet Get-User, parameters {Identity=NT AUTHORITY\SYSTEM}.

Commented:
Are there any custom powershell cmdlets for this server?  You can readmore about this at the link below..

http://msdn.microsoft.com/en-us/library/system.management.automation.pipelinestoppedexception.aspx

Author

Commented:
The last time today that can be the problem, I was running a powershell script for exchange (mailboximportrequest). But the first time nobody was executing some powershell script.

Author

Commented:
Sorry!

The first time i get the following messages (different from my previous message):

1. Cmdlet failed. Cmdlet Get-User, parameters {Identity=NT AUTHORITY\SYSTEM}.
2. Cmdlet failed. Cmdlet Get-User, parameters {Identity=NT AUTHORITY\SYSTEM}.
3. (PID 13964, Thread 152) Task Get-ExchangeCertificate throwing unhandled exception: System.Management.Automation.PipelineStoppedException: The pipeline has been stopped.
4. Cmdlet failed. Cmdlet Get-ExchangeCertificate, parameters {Server=Servername}.

Commented:
1 and 2 are common errors and are reportedly benign by Microsoft, I get them too in my logs.  I believe you issue is in 3 and 4.  But check your general Application event viewer too under windows logs, not just your MS Exchange, to see if theres anything more obvious arounfd the time emails stopped flowing

Author

Commented:
In system log:

1. (I think this is not the problem, it happens also the days before this day)

The description for Event ID 10009 from source Microsoft-Windows-DistributedCOM cannot be found. Either the component that raises this event is not installed on your local computer or the installation is corrupted. You can install or repair the component on the local computer.

If the event originated on another computer, the display information had to be saved with the event.

The following information was included with the event:

WIN-CR0HPLGEC8I.domainname.local


===================================================================
2. The following fatal alert was generated: 10. The internal error state is 1203.
===================================================================


And in application log (about 10 times this day, on various moments):

1. Watson report about to be sent for process id: 11752, with parameters: E12, c-RTL-AMD64, 14.01.0355.002, M.E.RpcClientAccess.Service, M.E.Data.Storage, M.E.D.S.StoreObjectId.Validate, M.E.D.Storage.CorruptDataException, 8e69, 14.01.0355.002.
ErrorReportingEnabled: False (Probably this was on the moment of rebooting the server)

===================================================================
2. Process Microsoft.Exchange.RpcClientAccess.Service.exe (PID=11752). User 'Sid~NT AUTHORITY\SYSTEM~RCA~false' has gone over budget '258' times for component 'RCA' within a one minute period. Info: 'Policy:[Fallback], Parts:CAS:257;'. Threshold value: '100'.
This happens multiple times a day.
===================================================================

Commented:
any update on this issue?  Did it happen again?
I is solved. It was a problem with our GFI  Mail Security (i have updated to the last version and the problems solved).

Thanks for any help

Author

Commented:
It was a problem with our GFI software