Still celebrating National IT Professionals Day with 3 months of free Premium Membership. Use Code ITDAY17

x
?
Solved

How to troubleshoot Mailbox Store edb and logs growing rapidly

Posted on 2013-05-22
6
Medium Priority
?
636 Views
Last Modified: 2013-10-29
Hello All,

I have an exchange organization with about 700 mailboxes on exchange server 2003 SP2 in a front end and back end configuration.

I use GFI MailEssentials for antispam and email security on the front end and for Informations store scanning on the back end.

I have four information stores each in a separate storage group. One of the stores; with 567 users (not well balanced numerically, I admit) has been growing rather rapidly and sporadically the last couple of days. In a given 4 hour period I lost about 1.6GB of space to the edb.

So far, I have checked the following:

SMTP Side:
-There is no NDR looping
-There is no visible spamming
-No open relay
-Normal mailflow

Stores Side:
-no corrupt mail is stuck in a queue
-Exmon shows no user taking up more operations or cpu time than necessary
-when the suspect mailbox store is dismounted, the problem stops momentarily.

Parsing the logs for the storage group holding the information store (collected for the period of increasing databases) using strings.exe (see http://blogs.msdn.com/b/scottos/archive/2007/07/12/rough-and-tough-guide-to-identifying-patterns-in-ese-transaction-log-files.aspx?PageIndex=3#comments) shows some emails occurring the following number of times within the logs collected during the   2 and half hour window:

3716       craiga@supplydirect.net
5583       bradt@supplydirect.net
3229       sales@pps-awb.co.uk
2602       jacheretrade@yahoo.co.uk
1900       mitchell.ackah@mospacka.com
1567          Internal User A
1368          Internal User B
135            Internal User C
All the above have one thing in common, they are suppliers and internal users A and B are supply officers.

Mail tracking shows no mail sent or received between Internal User B and any of the external accounts  but 1 email between Internal User C and craiga@supplydirect.net

Questions:
1. What else should I consider after all the above and what step should I take in resolving the issue?

2. Could a corruption in the mailbox store be the cause of this rapidly growing edb file and Exxx.logs?

Notes:

The following have recently occurred: server disk was replaced following drive failure. The server is in a RAID 5  array

The Active Directory FSMO roles were recently moved from server 2003 SP1 physical servers to corresponding server 2008R2 SP1 virtual servers into a VMware vSphere private cloud.
0
Comment
Question by:it_gsr
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 4
6 Comments
 
LVL 24

Expert Comment

by:Nagendra Pratap Singh
ID: 39187030
Is craiga@supplydirect.net getting lots of mails?

Are the mails relevant?
0
 

Author Comment

by:it_gsr
ID: 39187040
Nope.
Craiga is not getting a lot of emails from my exchange organization. He only received 3 emails from us during the period.
0
 
LVL 12

Accepted Solution

by:
SreRaj earned 1500 total points
ID: 39187076
In Exchange System Manager, expand mailbox store and click on mailbox folder. Right click on mailbox folder and select export list and save the file as csv. Do the same frequently in a 2 or 3 hour window so that we have multiple lists. Compare the lists for mailbox size and number of items and see if there is any abnormal growth for mailbox size or number of items for any of the mailboxes.
0
Technology Partners: We Want Your Opinion!

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

 

Author Comment

by:it_gsr
ID: 39187091
Hi SreRaj,

I was expecting ExMon to help me zero in on this (highly active user/s) when I used it to open the .etl log collected with perfmon for the activity period.

I will however use your sampling scheme as an alternative. I have started one now and will do so each hour for the next 4 hours.

I will revert with findings.
0
 

Author Comment

by:it_gsr
ID: 39188667
Hi SreRaj,

After over 5 hours of monitoring, there has not been any significant changes in the mailbox size or item count for the users (each of whom has a max of 300MB mailbox size configured).

For the day, there has not been any observed changes however in the storage space so I suppose the growth is not occurring  now. Only changes I have made on the BE server are to:

Disable basic authentication on the Default Virtual SMTP server
Stop and Disable the POP3 and IMAP4 services 9we do not use these) which were running.

Still Monitoring..
0
 

Author Closing Comment

by:it_gsr
ID: 39609003
The solution was disabling anonymous access on the default smtp server of the exchange 2003 backend server.
0

Featured Post

Will your db performance match your db growth?

In Percona’s white paper “Performance at Scale: Keeping Your Database on Its Toes,” we take a high-level approach to what you need to think about when planning for database scalability.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

A couple of months ago we ran into an issue that necessitated re-creating our Edge Subscriptions. However, when we attempted to execute the command: New-EdgeSubscription -filename C:\NewEdgeSub_01.xml we received an error indicating that the LDAP se…
New style of hardware planning for Microsoft Exchange server.
The video tutorial explains the basics of the Exchange server Database Availability groups. The components of this video include: 1. Automatic Failover 2. Failover Clustering 3. Active Manager
A short tutorial showing how to set up an email signature in Outlook on the Web (previously known as OWA). For free email signatures designs, visit https://www.mail-signatures.com/articles/signature-templates/?sts=6651 If you want to manage em…

705 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question