I have an exchange organization with about 700 mailboxes on exchange server 2003 SP2 in a front end and back end configuration.
I use GFI MailEssentials for antispam and email security on the front end and for Informations store scanning on the back end.
I have four information stores each in a separate storage group. One of the stores; with 567 users (not well balanced numerically, I admit) has been growing rather rapidly and sporadically the last couple of days. In a given 4 hour period I lost about 1.6GB of space to the edb.
So far, I have checked the following:
-There is no NDR looping
-There is no visible spamming
-No open relay
-no corrupt mail is stuck in a queue
-Exmon shows no user taking up more operations or cpu time than necessary
-when the suspect mailbox store is dismounted, the problem stops momentarily.
Parsing the logs for the storage group holding the information store (collected for the period of increasing databases) using strings.exe (see http://blogs.msdn.com/b/scottos/archive/2007/07/12/rough-and-tough-guide-to-identifying-patterns-in-ese-transaction-log-files.aspx?PageIndex=3#comments
) shows some emails occurring the following number of times within the logs collected during the 2 and half hour window:
1567 Internal User A
1368 Internal User B
135 Internal User C
All the above have one thing in common, they are suppliers and internal users A and B are supply officers.
Mail tracking shows no mail sent or received between Internal User B and any of the external accounts but 1 email between Internal User C and firstname.lastname@example.org
1. What else should I consider after all the above and what step should I take in resolving the issue?
2. Could a corruption in the mailbox store be the cause of this rapidly growing edb file and Exxx.logs?
The following have recently occurred: server disk was replaced following drive failure. The server is in a RAID 5 array
The Active Directory FSMO roles were recently moved from server 2003 SP1 physical servers to corresponding server 2008R2 SP1 virtual servers into a VMware vSphere private cloud.