Solved

How to troubleshoot Mailbox Store edb and logs growing rapidly

Posted on 2013-05-22
6
619 Views
Last Modified: 2013-10-29
Hello All,

I have an exchange organization with about 700 mailboxes on exchange server 2003 SP2 in a front end and back end configuration.

I use GFI MailEssentials for antispam and email security on the front end and for Informations store scanning on the back end.

I have four information stores each in a separate storage group. One of the stores; with 567 users (not well balanced numerically, I admit) has been growing rather rapidly and sporadically the last couple of days. In a given 4 hour period I lost about 1.6GB of space to the edb.

So far, I have checked the following:

SMTP Side:
-There is no NDR looping
-There is no visible spamming
-No open relay
-Normal mailflow

Stores Side:
-no corrupt mail is stuck in a queue
-Exmon shows no user taking up more operations or cpu time than necessary
-when the suspect mailbox store is dismounted, the problem stops momentarily.

Parsing the logs for the storage group holding the information store (collected for the period of increasing databases) using strings.exe (see http://blogs.msdn.com/b/scottos/archive/2007/07/12/rough-and-tough-guide-to-identifying-patterns-in-ese-transaction-log-files.aspx?PageIndex=3#comments) shows some emails occurring the following number of times within the logs collected during the   2 and half hour window:

3716       craiga@supplydirect.net
5583       bradt@supplydirect.net
3229       sales@pps-awb.co.uk
2602       jacheretrade@yahoo.co.uk
1900       mitchell.ackah@mospacka.com
1567          Internal User A
1368          Internal User B
135            Internal User C
All the above have one thing in common, they are suppliers and internal users A and B are supply officers.

Mail tracking shows no mail sent or received between Internal User B and any of the external accounts  but 1 email between Internal User C and craiga@supplydirect.net

Questions:
1. What else should I consider after all the above and what step should I take in resolving the issue?

2. Could a corruption in the mailbox store be the cause of this rapidly growing edb file and Exxx.logs?

Notes:

The following have recently occurred: server disk was replaced following drive failure. The server is in a RAID 5  array

The Active Directory FSMO roles were recently moved from server 2003 SP1 physical servers to corresponding server 2008R2 SP1 virtual servers into a VMware vSphere private cloud.
0
Comment
Question by:it_gsr
  • 4
6 Comments
 
LVL 23

Expert Comment

by:Nagendra Pratap Singh
ID: 39187030
Is craiga@supplydirect.net getting lots of mails?

Are the mails relevant?
0
 

Author Comment

by:it_gsr
ID: 39187040
Nope.
Craiga is not getting a lot of emails from my exchange organization. He only received 3 emails from us during the period.
0
 
LVL 12

Accepted Solution

by:
SreRaj earned 500 total points
ID: 39187076
In Exchange System Manager, expand mailbox store and click on mailbox folder. Right click on mailbox folder and select export list and save the file as csv. Do the same frequently in a 2 or 3 hour window so that we have multiple lists. Compare the lists for mailbox size and number of items and see if there is any abnormal growth for mailbox size or number of items for any of the mailboxes.
0
Independent Software Vendors: We Want Your Opinion

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

 

Author Comment

by:it_gsr
ID: 39187091
Hi SreRaj,

I was expecting ExMon to help me zero in on this (highly active user/s) when I used it to open the .etl log collected with perfmon for the activity period.

I will however use your sampling scheme as an alternative. I have started one now and will do so each hour for the next 4 hours.

I will revert with findings.
0
 

Author Comment

by:it_gsr
ID: 39188667
Hi SreRaj,

After over 5 hours of monitoring, there has not been any significant changes in the mailbox size or item count for the users (each of whom has a max of 300MB mailbox size configured).

For the day, there has not been any observed changes however in the storage space so I suppose the growth is not occurring  now. Only changes I have made on the BE server are to:

Disable basic authentication on the Default Virtual SMTP server
Stop and Disable the POP3 and IMAP4 services 9we do not use these) which were running.

Still Monitoring..
0
 

Author Closing Comment

by:it_gsr
ID: 39609003
The solution was disabling anonymous access on the default smtp server of the exchange 2003 backend server.
0

Featured Post

Problems using Powershell and Active Directory?

Managing Active Directory does not always have to be complicated.  If you are spending more time trying instead of doing, then it's time to look at something else. For nearly 20 years, AD admins around the world have used one tool for day-to-day AD management: Hyena. Discover why

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Following basic email etiquette rules will help you write a professional email and achieve a good, lasting impression with your contacts.
How to resolve IMCEAEX NDRs in Exchange or Exchange Online related to invalid X500 addresses.
To show how to generate a certificate request in Exchange 2013. We show this process by using the Exchange Admin Center. Log into Exchange Admin Center.:  First we need to log into the Exchange Admin Center. Navigate to the Servers >> Certificates…
This video demonstrates how to sync Microsoft Exchange Public Folders with smartphones using CodeTwo Exchange Sync and Exchange ActiveSync. To learn more about CodeTwo Exchange Sync and download the free trial, go to: http://www.codetwo.com/excha…

680 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question