Improve company productivity with a Business Account.Sign Up

x
?
Solved

How to troubleshoot Mailbox Store edb and logs growing rapidly

Posted on 2013-05-22
6
Medium Priority
?
650 Views
Last Modified: 2013-10-29
Hello All,

I have an exchange organization with about 700 mailboxes on exchange server 2003 SP2 in a front end and back end configuration.

I use GFI MailEssentials for antispam and email security on the front end and for Informations store scanning on the back end.

I have four information stores each in a separate storage group. One of the stores; with 567 users (not well balanced numerically, I admit) has been growing rather rapidly and sporadically the last couple of days. In a given 4 hour period I lost about 1.6GB of space to the edb.

So far, I have checked the following:

SMTP Side:
-There is no NDR looping
-There is no visible spamming
-No open relay
-Normal mailflow

Stores Side:
-no corrupt mail is stuck in a queue
-Exmon shows no user taking up more operations or cpu time than necessary
-when the suspect mailbox store is dismounted, the problem stops momentarily.

Parsing the logs for the storage group holding the information store (collected for the period of increasing databases) using strings.exe (see http://blogs.msdn.com/b/scottos/archive/2007/07/12/rough-and-tough-guide-to-identifying-patterns-in-ese-transaction-log-files.aspx?PageIndex=3#comments) shows some emails occurring the following number of times within the logs collected during the   2 and half hour window:

3716       craiga@supplydirect.net
5583       bradt@supplydirect.net
3229       sales@pps-awb.co.uk
2602       jacheretrade@yahoo.co.uk
1900       mitchell.ackah@mospacka.com
1567          Internal User A
1368          Internal User B
135            Internal User C
All the above have one thing in common, they are suppliers and internal users A and B are supply officers.

Mail tracking shows no mail sent or received between Internal User B and any of the external accounts  but 1 email between Internal User C and craiga@supplydirect.net

Questions:
1. What else should I consider after all the above and what step should I take in resolving the issue?

2. Could a corruption in the mailbox store be the cause of this rapidly growing edb file and Exxx.logs?

Notes:

The following have recently occurred: server disk was replaced following drive failure. The server is in a RAID 5  array

The Active Directory FSMO roles were recently moved from server 2003 SP1 physical servers to corresponding server 2008R2 SP1 virtual servers into a VMware vSphere private cloud.
0
Comment
Question by:it_gsr
  • 4
6 Comments
 
LVL 25

Expert Comment

by:Nagendra Pratap Singh
ID: 39187030
Is craiga@supplydirect.net getting lots of mails?

Are the mails relevant?
0
 

Author Comment

by:it_gsr
ID: 39187040
Nope.
Craiga is not getting a lot of emails from my exchange organization. He only received 3 emails from us during the period.
0
 
LVL 12

Accepted Solution

by:
SreRaj earned 1500 total points
ID: 39187076
In Exchange System Manager, expand mailbox store and click on mailbox folder. Right click on mailbox folder and select export list and save the file as csv. Do the same frequently in a 2 or 3 hour window so that we have multiple lists. Compare the lists for mailbox size and number of items and see if there is any abnormal growth for mailbox size or number of items for any of the mailboxes.
0
Simplify Active Directory Administration

Administration of Active Directory does not have to be hard.  Too often what should be a simple task is made more difficult than it needs to be.The solution?  Hyena from SystemTools Software.  With ease-of-use as well as powerful importing and bulk updating capabilities.

 

Author Comment

by:it_gsr
ID: 39187091
Hi SreRaj,

I was expecting ExMon to help me zero in on this (highly active user/s) when I used it to open the .etl log collected with perfmon for the activity period.

I will however use your sampling scheme as an alternative. I have started one now and will do so each hour for the next 4 hours.

I will revert with findings.
0
 

Author Comment

by:it_gsr
ID: 39188667
Hi SreRaj,

After over 5 hours of monitoring, there has not been any significant changes in the mailbox size or item count for the users (each of whom has a max of 300MB mailbox size configured).

For the day, there has not been any observed changes however in the storage space so I suppose the growth is not occurring  now. Only changes I have made on the BE server are to:

Disable basic authentication on the Default Virtual SMTP server
Stop and Disable the POP3 and IMAP4 services 9we do not use these) which were running.

Still Monitoring..
0
 

Author Closing Comment

by:it_gsr
ID: 39609003
The solution was disabling anonymous access on the default smtp server of the exchange 2003 backend server.
0

Featured Post

Problems using Powershell and Active Directory?

Managing Active Directory does not always have to be complicated.  If you are spending more time trying instead of doing, then it's time to look at something else. For nearly 20 years, AD admins around the world have used one tool for day-to-day AD management: Hyena. Discover why

Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

Join & Write a Comment

This is a very interesting topic. Ransomware has been around for a while but has increased drastically over the last year or so.
In a Cross Forest, the steps to migrate users are quite complicated and even in the official articles of Technet there is no clear recommendation on which approach to take .. From an experience, I mention and simplify which way to go and how to use …
The video tutorial explains the basics of the Exchange server Database Availability groups. The components of this video include: 1. Automatic Failover 2. Failover Clustering 3. Active Manager
This video discusses moving either the default database or any database to a new volume.

606 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question