Solved

VM Exchange services dropping every night... HELP!!

Posted on 2012-03-13
11
474 Views
Last Modified: 2012-03-22
Having a very peculiar issue with my Exchange VM server. Every night the services begin to  error then W3SVC stops and Blackberry Dispatcher stops. My clients lose RPC over HTTP access and of course Blackberries stop receiving email. I don't know what is causing the spike in CPU and service stoppage overnight.

VM Server Details
OS: Windows Server 2003 SP2
CPU: 3.00 GHz
RAM: 3 GB


Details
Blackberry Controller began having issues (the service never stopped, but threw out warnings for the next few hours)
Event 20000 – Source: Blackberry Controller

Browser warnings and then immediately following was the SMTPSVC & W3SVC service errors
Event 8021 & 8032 – Source: Browser
Event 2012 – Source: SMTPSVC
Event 1120 & 1121 – Source: W3SVC

CPU running at 100% for a couple hours
Processes causing the bottleneck
Svchost (I couldn’t figure out which one it was, as there are about 7 of them) – forgot to add the PID column in task manager
Sqlservr PID 1612 [SQL Blackberry]

Memory usage up over 3 GB
Processes memory hogs:
Store climbed up to nearly 1 GB (after a reboot, store is at about 100 MB)
BAS-AS sits at 600 MB
Inetinfo also jumped up to a couple hundred MB (don’t remember how much)
0
Comment
Question by:IAmDH
  • 5
  • 3
  • 2
  • +1
11 Comments
 
LVL 8

Expert Comment

by:Elmar-H
Comment Utility
You have a Backup Job for this time ?!
0
 

Author Comment

by:IAmDH
Comment Utility
ntbackup has a scheduled backup job that supposed to run at 6:00pm, but it hasn't been running right now. My problem doesn't even start until about midnight.
0
 
LVL 8

Expert Comment

by:thomasdavis
Comment Utility
What is the first error in the event viewer at that time for system?
0
 
LVL 41

Expert Comment

by:Amit
Comment Utility
It seems online defrag might be running during that time, it might be conflicting with backup time too. That could be the reason for spike, change the online defrag time, so it should not conflict with backup time. Also make sure you have AV exclusion set properly. You can put the /3gb switch also and increase ram to 4 GB if possible.
0
 

Author Comment

by:IAmDH
Comment Utility
@ThomasDavis Event 8021 & 8032 – Source: Browser is the first, immediately followed by the others that I listed above. These are in the system event log

Also, I did have the Blackberry Controller warning that I listed, that preempted all of the above. This was in the application log.
0
What Should I Do With This Threat Intelligence?

Are you wondering if you actually need threat intelligence? The answer is yes. We explain the basics for creating useful threat intelligence.

 

Author Comment

by:IAmDH
Comment Utility
@amitkulshrestha Thanks for that. I will give it a try. 3 GB switch is already in place.

Question: does the Online defrag have to be done after hours? The reason I ask, is that there isn't much of a window for this client as they are a hotel and hours are much longer than a regular business day. If the online defrag causes performance issues then my window for having it performed is still pretty small.
0
 
LVL 8

Expert Comment

by:thomasdavis
Comment Utility
The online defrag can be ran at anytime its best to do this during off peak hours, you can change the maintenance schedule for the database in properties of the storage group. Mine take a few hours to run.. You'll see this in event view under application "source" ESC
0
 
LVL 8

Expert Comment

by:thomasdavis
Comment Utility
I would suggest to upgrade the ram to at least 4 if possible.
0
 
LVL 41

Accepted Solution

by:
Amit earned 500 total points
Comment Utility
It seems, this server is used 24/7, first you check if DC is working fine, with the question details, i can see that server is overloaded, as you are running Exchange, BES and SQL also in same server, the best method is to have them in separate servers, atleast exchange should be installed alone.

Run Process Explorer
http://technet.microsoft.com/en-us/sysinternals/bb896653

This will help to determine which process is causing spike
0
 

Author Comment

by:IAmDH
Comment Utility
I've created a new VM and have moved BES/SQL & Cloudmark to it.

I'm going to see what happens tonight with my Exchange server.

Will update on my findings...
0
 

Author Closing Comment

by:IAmDH
Comment Utility
After moving the BES and its SQL the server has settled down. Thanks for your help everyone...
0

Featured Post

Integrate social media with email signatures

Is your company active on social media? Do you also use email signatures? Including social media icons in your email signature is a great way to get fans for free. Let all your email users know you’re on social media quickly and easily, in a single click.

Join & Write a Comment

Local Continuous Replication is a cost effective and quick way of backing up Exchange server data. The following article describes the steps required to configure Local Continuous Replication. Also, the article tells you how to restore from a backup…
Marketers need statistics and metrics like everybody else needs oxygen. In this article we explain how to enable marketing campaign statistics for Microsoft Exchange mail.
In this video we show how to create a Distribution Group in Exchange 2013. We show this process by using the Exchange Admin Center. Log into Exchange Admin Center.: First we need to log into the Exchange Admin Center. Navigate to the Recipients >>…
In this video we show how to create an email address policy in Exchange 2013. We show this process by using the Exchange Admin Center. Log into Exchange Admin Center.:  First we need to log into the Exchange Admin Center. Navigate to the Mail Flow…

763 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

14 Experts available now in Live!

Get 1:1 Help Now