Exchange 2010 Transport Service Dead Totally

Long shot in the dark but is there enough free space on the disk?

30gb :)

What do the event logs say?

Have you run a netstat -ano on your server? Is the transport service listening on port 25? If not what is listed on port 25 as listening?

If you want to cut down on all the returned netstat values and look only at port 25 you can use this:

netstat -an | findstr :25

That will display all services listening on that port.

as stated there is nothing on port 25 listening - there is no record of port 25 in the netstat -ano command

as for logs there is nothing erroring - a few warnings - should i increase hte level of logging and which logging should i query

Turn on transport logging.
http://exchangeserverpro.com/exchange-server-protocol-logging/

Is outbound mail working at least?

Yes you should make sure you have diagnostic logging enabled for MSExchangeTransport Service.

http://technet.microsoft.com/en-us/library/dd335139.aspx

It will help us find the cause.

anyone care to point me to which ones i need to turn on

MSEchangeTransport
  smtpreceive
  transportservice

any otehrs?

transport should be enough.

ok so are these the same logs in application of event viewer or somewhere else now

in EViewer

Error
Description:
Watson report about to be sent for process id: 18412, with parameters: E12, c-RTL-AMD64, 14.03.0123.004, edgetransport, M.E.Extensibility.Internal, M.E.D.M.I.MimeCacheMap.Load, M.E.D.Mime.MimeException, 8c10, 14.03.0123.002.
ErrorReportingEnabled: False

some warnings and some information including

warning
The topology doesn't contain a route to Exchange 2000 Server or Exchange Server 2003 sbs.hills.local in Routing Group CN=first routing group,CN=Routing Groups,CN=first administrative group,CN=Administrative Groups,CN=HILLS,CN=Microsoft Exchange,CN=Services,CN=Configuration,DC=hills,DC=local in routing tables with the timestamp 11/11/2014 19:38:00.

(this was an upgrade from 2003 SBS over a year ago, ans SBS was the old server)

warning
Transport service is disconnecting performance counters with process lifetime from their old process.

warning
The process with process ID 8364 is holding the performance counter server alive Value=0 SpinLock=0 Lifetime=Type: 1 ProcessId: 8364 StartupTime: 130602081202570109 from instance _total(CFBEE918) RefCount=0 SpinLock=0 Offset=32 and category MSExchangeTransport ServerAlive while running processes are: Processes running are:
1772 certsrv
8152 MSExchangeMailboxReplication
2164 MSExchangeADTopologyService
11816 explorer
192 LogonUI
1712 Microsoft.ActiveDirectory.WebServices
7632 MSExchangeMailboxAssistants
8264 fdhost
2156 svchost
4716 MgntSvc
11256 csrss
1168 svchost
2940 sqlservr
4908 svchost
17712 msftefd
12240 dllhost
16788 w3wp
1752 svchost
372 svchost
7616 robocopy
548 wininit
7388 Microsoft.Exchange.ProtectedServiceHost
7852 Microsoft.Exchange.ServiceHost
956 svchost
8252 w3wp
5288 conhost
14940 conhost
5696 fdlauncher
6072 svchost
1044 ServiceApp
11192 winlogon
4492 CertificationManagerServiceNT
8364 MSExchangeTransport
13304 conhost
1336 sqlservr
5472 SUMService
11972 BACSTray
1136 svchost
10788 mscorsvw
4728 ManagementAgentNT
11968 MtxHotPlugService
540 csrss
3888 svchost
6820 Microsoft.Exchange.AntispamUpdateSvc
2500 mqsvc
1908 dns
5312 mssdmn
6040 conhost
2296 store
3280 sqlservr
9780 fdlauncher
13300 w3wp
7104 Microsoft.Exchange.AddressBook.Service
11272 rdpclip
2880 sqlservr
8520 conhost
11940 tmon
1888 svchost
7008 msexchangerepl
15760 taskeng
1684 spoolsv
500 csrss
12516 w3wp
7196 MsExchangeFDS
11464 taskhost
496 svchost
6208 svchost
1084 ismserv
8116 Microsoft.Exchange.RpcClientAccess.Service
7160 Microsoft.Exchange.EdgeSyncSvc
2460 msftesql
15180 w3wp
8564 MSExchangeTransportLogSearch
6000 wsstracing
10528 mmc
5996 sqlwriter
11708 mbam
10516 mscorsvw
19176 mmc
1064 svchost
11344 w3wp
2244 exfba
864 svchost
1848 dfsrs
4272 svchost
9724 w3wp
13436 w3wp
1644 mbamscheduler
8468 SMSvcHost
3612 sqlservr
656 lsm
13920 powershell
10724 w3wp
452 TrustedInstaller
648 lsass
10300 msdtc
4192 silsvc
18960 mmc
10100 vds
12464 wuauclt
4384 ntfrs
640 services
5564 Microsoft.Exchange.Search.ExSearch
4576 snmp
8712 MSExchangeThrottling
4180 RouterNT
5952 OWSTIMER
11308 conhost
1948 inetinfo
6152 tsvc
6736 DataCollectorSvc
11660 dwm
12272 SearchIndexer
2132 mbamservice
2396 mad
5376 svchost
6924 dfssvc
816 svchost
5756 mssearch
13028 svchost
6328 wsusservice
5396 SophosUpdateMgr
4356 WSSADMIN
6128 SPWRITER
216 svchost
9276 fdhost
12988 cmd
4940 svchost
3952 SMSvcHost
9728 w3wp
18344 cmd
388 smss
8872 iashost
9856 dllhost
7688 MSExchangeMailSubmission
4 System
592 winlogon
0 Idle

no outgoing mail either

Ignore the performance counter errors, they're just caused because the transport service is being restarted. Filter events from MSExchangeTransport and cross-reference here: http://technet.microsoft.com/en-us/library/hh994900%28v=exchg.141%29.aspx

MSExchangeTransport

16022   A configuration update for %1 has successfully completed.  (lots of these 6 every few seconds)

17008 The Microsoft Exchange Transport service has started the background scan of the queue database. All messages that have not yet been delivered will be loaded.

12025 Transport service is disconnecting performance counters with process lifetime from their old process.

12028 The process with process ID 8364 is holding the performance counter server alive Value=0 SpinLock=0 Lifetime=Type: 1 ProcessId: 8364 StartupTime: 130602081202570109 from instance _total(CFBEE918) RefCount=0 SpinLock=0 Offset=32 and category MSExchangeTransport ServerAlive while running processes are: Processes running are:

MSExchangeTransport 5020
      
Routing
      
Warning
      
The topology doesn't contain a route to Exchange 2000 Server or Exchange Server 2003 %1 in Routing Group %2 in routing tables with the timestamp %3.


MSExchangeTransport 5006
      
Routing
      
Error
      
Cannot find route to Mailbox Server %1 for store %2 in routing tables with timestamp %3. Recipients will not be routed to this store.

7004

The activation of all modules took longer than expected to complete. Total Load Time: 00:00:15.3658706 Total Start Time: 00:00:00.0389088 Load Time Breakdown:
Load Configuration Certificate and Database components:00:00:14.7794395
>> Detailed breakdown begin:
Load Database and dependents:00:00:14.7789618
>> Detailed breakdown begin:
Load Database:00:00:03.6858875
Load BatchPointComponent:00:00:00.0017699
Load ResourceManager:00:00:00.0000594
Load Database:00:00:11.0910391
>> Detailed breakdown end.
Load TransportConfiguration:00:00:00.4880358
Load CertificateComponent:00:00:00.0280938
Load RemoteDeliveryComponent:00:00:00.0000406
>> Detailed breakdown end.
Load AgentComponent:00:00:00.0755465
Load AD Configuration Readers:00:00:00.0983438
>> Detailed breakdown begin:
Load IsMemberOfResolverComponent`1:00:00:00.0061964
Load IsMemberOfResolverComponent`1:00:00:00.0035697
Load Dumpster and depedent components:00:00:00.0011090
>> Detailed breakdown begin:
Load TransportDumpster:00:00:00.0008665
Load TransportMailItemLoader:00:00:00.0001475
>> Detailed breakdown end.
Load OrarGenerator:00:00:00.0092153
Load DsnGenerator:00:00:00.0275031
Load PerfCountersLoader:00:00:00.0110656
Load LoggingComponent:00:00:00.0197934
Load PoisonMessage:00:00:00.0004516
Load DirectTrustLoader:00:00:00.0138839
Load MicrosoftExchangeRecipientLoader:00:00:00.0169648
Load ServicePrincipalNameRegistrar:00:00:00.0425898
Load CategorizerMExRuntimeLoader:00:00:00.0889044
Load MessageThrottlingComponent:00:00:00.0005825
Load RmsClientManager:00:00:00.0000119
Load ShadowRedundancy:00:00:00.0240073
>> Detailed breakdown end.
Load AD/Database Dependent Components:00:00:00.0056288
>> Detailed breakdown begin:
Load QueueManager:00:00:00.0055210
Load RpcServerComponent:00:00:00.0021176
>> Detailed breakdown end.
Load CategorizerComponent:00:00:00.1667273
Load Categorizer Dependent Components:00:00:00.2398362
>> Detailed breakdown begin:
Load SmtpInComponent:00:00:00.0088911
Load StoreDriverLoader:00:00:00.2396540
Load PickupComponent:00:00:00.0000290
Load BackgroundMailScanner:00:00:00.0000282
Load SmtpOut:00:00:00.0016907
Load NonSmtpGatewayConnectionHandler:00:00:00.0000111
Load DeliveryAgentConnectionHandler:00:00:00.0014919
Load AggregatorLoader:00:00:00.0261019
>> Detailed breakdown end.
Load BackgroundProcessingThread:00:00:00.0000269 Start Time Breakdown:
Start Configuration Certificate and Database components:00:00:00.0003165
>> Detailed breakdown begin:
Start Database and dependents:00:00:00.0002694
>> Detailed breakdown begin:
Start BatchPointComponent:00:00:00.0002540
>> Detailed breakdown end.
Start RemoteDeliveryComponent:00:00:00.0000162
>> Detailed breakdown end.
Start AD Configuration Readers:00:00:00.0109566
>> Detailed breakdown begin:
Start Dumpster and depedent components:00:00:00.0109412
>> Detailed breakdown begin:
Start TransportDumpster:00:00:00.0109232
>> Detailed breakdown end.
>> Detailed breakdown end.
Start AD/Database Dependent Components:00:00:00.0000021
Start CategorizerComponent:00:00:00.0000145
Start Categorizer Dependent Components:00:00:00.0195260
>> Detailed breakdown begin:
Start SmtpInComponent:00:00:00.0051703
Start StoreDriverLoader:00:00:00.0140460
Start PickupComponent:00:00:00.0000145
Start BackgroundMailScanner:00:00:00.0000089
Start SmtpOut:00:00:00.0000953
Start NonSmtpGatewayConnectionHandler:00:00:00.0000085
Start DeliveryAgentConnectionHandler:00:00:00.0000047
Start AggregatorLoader:00:00:00.0000846
>> Detailed breakdown end.
Start BackgroundProcessingThread:00:00:00.0079924

Which of your servers is the 5006 error referring to?

5006 refers to the defunct sbs2003 server which ahs been off for over a year

I would expect to see Event 16023 or 1052 if you could not start the Transport Service. Can you attempt to start it again and check for those?
http://www.microsoft.com/technet/support/ee/transform.aspx?ProdName=Exchange&ProdVer=8.0&EvtID=16023&EvtSrc=MSExchangeTransport&LCID=1033

Good luck, I will be going offline but will check back on you tomorrow!

neither :(

anyone :(

DATA folder being the key