exchange 2010, Active directory

I am getting error on my exchange server -HIGH LDAP search time .sustained for 2 minutes .yellow (>100 milliseconds)

what should I do, should I ignore
pramod1Asked:
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

Will SzymkowskiSenior Solution ArchitectCommented:
Did this event just start happening? How many DC do you have in the site where Exchange is hosted? Basically it is stating that it cannot keep up to the queries that users are requesting. I would check to see what your DC are doing and make sure that they have available resources as well (CPU and memory). You should also check and make sure the you network latency is also good.

Checking DC replication also wouldn't hurt. Probably not a good idea to just let this go. Are your clients complaining?

Will.
0
pramod1Author Commented:
this error was generated 3 hrs back and is from exchange relay server
0
pramod1Author Commented:
how do I check network latency
0
Has Powershell sent you back into the Stone Age?

If managing Active Directory using Windows Powershell® is making you feel like you stepped back in time, you are not alone.  For nearly 20 years, AD admins around the world have used one tool for day-to-day AD management: Hyena. Discover why.

Put the Hammer Down
Will SzymkowskiSenior Solution ArchitectCommented:
A simple ping can show the network latency. You can also use pathping as well.

I personally think it is to do with the resources on the DC's

Will.
0
pramod1Author Commented:
what should be ldap normal search time
0
pramod1Author Commented:
as I did tracert to google.com , all hops show less than 30 ms
0
pramod1Author Commented:
what should be ldap normal search time , all dc are in site
0
pramod1Author Commented:
if tracert  is less than 25ms , what should be the ldap search time?
0
Will SzymkowskiSenior Solution ArchitectCommented:
you get 25ms on the same LAN? That seems high.

Or is this over a MPLS or IPSec VPN?

What about the resources on the DC's?

Will.
0
Scott CSenior Systems EnginerCommented:
On your DC change the following registry key.

HKLM\SYSTEM\CurrentControlSet\services\NTDS\Diagnostics

Change 15 Field Engineering to a Value of "5"

Once this is set look in the Directory Services log for event ID 1644.


If this Event ID shows up install HOTFIX http://support.microsoft.com/kb/2862304 on all DCs that Exchange uses.

LDAP Read and Search times should be under 15 with spikes not higher than 50.

To check for high LDAP times, run ExPerfWiz for about an hour or two and then open up the data and look at MSExchange ADAccess Domain Controllers and then LDAP Read Time and LDAP Search Time.

https://experfwiz.codeplex.com/

You didn't say what version of Windows you are running for your Domain Controllers.  The above applies to 2008 R2 SP1 and above.  If you are using 2003 you need to upgrade your DCs and apply the above hotfix.
0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
pramod1Author Commented:
tracert to google  took less than 10ms
0
Scott CSenior Systems EnginerCommented:
Just saw you accepted my solution.

Glad to have been able to help you so quickly.

When I was an Exchange Escalation engineer for MS this was the first thing we did when seeing high LDAP times.
0
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Active Directory

From novice to tech pro — start learning today.

Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.