Solved

How to troubleshoot Mailbox Store edb and logs growing rapidly

Posted on 2013-05-22
6
611 Views
Last Modified: 2013-10-29
Hello All,

I have an exchange organization with about 700 mailboxes on exchange server 2003 SP2 in a front end and back end configuration.

I use GFI MailEssentials for antispam and email security on the front end and for Informations store scanning on the back end.

I have four information stores each in a separate storage group. One of the stores; with 567 users (not well balanced numerically, I admit) has been growing rather rapidly and sporadically the last couple of days. In a given 4 hour period I lost about 1.6GB of space to the edb.

So far, I have checked the following:

SMTP Side:
-There is no NDR looping
-There is no visible spamming
-No open relay
-Normal mailflow

Stores Side:
-no corrupt mail is stuck in a queue
-Exmon shows no user taking up more operations or cpu time than necessary
-when the suspect mailbox store is dismounted, the problem stops momentarily.

Parsing the logs for the storage group holding the information store (collected for the period of increasing databases) using strings.exe (see http://blogs.msdn.com/b/scottos/archive/2007/07/12/rough-and-tough-guide-to-identifying-patterns-in-ese-transaction-log-files.aspx?PageIndex=3#comments) shows some emails occurring the following number of times within the logs collected during the   2 and half hour window:

3716       craiga@supplydirect.net
5583       bradt@supplydirect.net
3229       sales@pps-awb.co.uk
2602       jacheretrade@yahoo.co.uk
1900       mitchell.ackah@mospacka.com
1567          Internal User A
1368          Internal User B
135            Internal User C
All the above have one thing in common, they are suppliers and internal users A and B are supply officers.

Mail tracking shows no mail sent or received between Internal User B and any of the external accounts  but 1 email between Internal User C and craiga@supplydirect.net

Questions:
1. What else should I consider after all the above and what step should I take in resolving the issue?

2. Could a corruption in the mailbox store be the cause of this rapidly growing edb file and Exxx.logs?

Notes:

The following have recently occurred: server disk was replaced following drive failure. The server is in a RAID 5  array

The Active Directory FSMO roles were recently moved from server 2003 SP1 physical servers to corresponding server 2008R2 SP1 virtual servers into a VMware vSphere private cloud.
0
Comment
Question by:it_gsr
  • 4
6 Comments
 
LVL 23

Expert Comment

by:Nagendra Pratap Singh
ID: 39187030
Is craiga@supplydirect.net getting lots of mails?

Are the mails relevant?
0
 

Author Comment

by:it_gsr
ID: 39187040
Nope.
Craiga is not getting a lot of emails from my exchange organization. He only received 3 emails from us during the period.
0
 
LVL 12

Accepted Solution

by:
SreRaj earned 500 total points
ID: 39187076
In Exchange System Manager, expand mailbox store and click on mailbox folder. Right click on mailbox folder and select export list and save the file as csv. Do the same frequently in a 2 or 3 hour window so that we have multiple lists. Compare the lists for mailbox size and number of items and see if there is any abnormal growth for mailbox size or number of items for any of the mailboxes.
0
Optimizing Cloud Backup for Low Bandwidth

With cloud storage prices going down a growing number of SMBs start to use it for backup storage. Unfortunately, business data volume rarely fits the average Internet speed. This article provides an overview of main Internet speed challenges and reveals backup best practices.

 

Author Comment

by:it_gsr
ID: 39187091
Hi SreRaj,

I was expecting ExMon to help me zero in on this (highly active user/s) when I used it to open the .etl log collected with perfmon for the activity period.

I will however use your sampling scheme as an alternative. I have started one now and will do so each hour for the next 4 hours.

I will revert with findings.
0
 

Author Comment

by:it_gsr
ID: 39188667
Hi SreRaj,

After over 5 hours of monitoring, there has not been any significant changes in the mailbox size or item count for the users (each of whom has a max of 300MB mailbox size configured).

For the day, there has not been any observed changes however in the storage space so I suppose the growth is not occurring  now. Only changes I have made on the BE server are to:

Disable basic authentication on the Default Virtual SMTP server
Stop and Disable the POP3 and IMAP4 services 9we do not use these) which were running.

Still Monitoring..
0
 

Author Closing Comment

by:it_gsr
ID: 39609003
The solution was disabling anonymous access on the default smtp server of the exchange 2003 backend server.
0

Featured Post

PRTG Network Monitor: Intuitive Network Monitoring

Network Monitoring is essential to ensure that computer systems and network devices are running. Use PRTG to monitor LANs, servers, websites, applications and devices, bandwidth, virtual environments, remote systems, IoT, and many more. PRTG is easy to set up & use.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Marketers need statistics and metrics like everybody else needs oxygen. In this article we explain how to enable marketing campaign statistics for Microsoft Exchange mail.
Read this checklist to learn more about the 15 things you should never include in an email signature.
In this video we show how to create a Resource Mailbox in Exchange 2013. We show this process by using the Exchange Admin Center. Log into Exchange Admin Center.: Navigate to the Recipients >> Resources tab.: "Recipients" is our default selection …
The basic steps you have just learned will be implemented in this video. The basic steps are shown to configure an Exchange DAG in a live working Exchange Server Environment and manage the same (Exchange Server 2010 Software is used in a Windows Ser…

860 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question