I'm running Exchange Server 2013 SP1 that was losing its 1.9 TB Database disk for 2 hours, and then back online again all in a sudden.
So the timing is like:
9:00 PM - 9:30 PM, I am doing my change to delete the oversized Mail.que:
1. Go to services.msc and Pause the Microsoft Exchange Transport service.
2. Run “Get-Queue | ft -AutoSize” and ensure all pending messages are clearing out to be very minimal under 10.
3. Stop the Microsoft Exchange Transport service
4. Set Microsoft Exchange Transport service to "Disabled"
5. Rename mail.queue file
6. Set Microsoft Exchange Transport service to "Automatic"
7. Reboot the Exchange server
8. Run “Get-Queue | ft -AutoSize” and ensure all pending messages are clearing out.
after the reboot, the Windows Server is rebooting itself again, but then this time its worst, the D:\ drive where all of the Exchange mailbox DB went missing due to the D:\ drive has become RAW instead of NTFS for about 2-2.5 hours.
11:45 PM yesterday, the D:\ drive is mysteriously back online again as NTFS drive, all emails are flowing back as normal.
But then I've got some users more than half reporting that they are missing their yesterday's email even before the maintenance window yesterday at 9:00 PM ?
The email today is working fine from everyone, but some of my users did lose their yesterday emails?
Looking through Exchange Transaction logs, I can see some emails within the outage window:
Timestamp EventId Source
14/06/2017 21:00 DELIVER STOREDRIVER
14/06/2017 23:05 DUPLICATEDELIVER STOREDRIVER
14/06/2017 21:22 RECEIVE STOREDRIVER
14/06/2017 21:22 SUBMIT STOREDRIVER
14/06/2017 21:00 EXPAND ROUTING
14/06/2017 21:00 AGENTINFO AGENT
14/06/2017 21:00 TRANSFER ROUTING
14/06/2017 21:00 SEND SMTP
14/06/2017 21:05 HAREDIRECT SMTP
14/06/2017 21:05 RECEIVE SMTP
14/06/2017 22:00 HARECEIVE SMTP
14/06/2017 23:06 HADISCARD SMTP
14/06/2017 21:20 HAREDIRECTFAIL SMTP
14/06/2017 21:43 DEFER SMTP
14/06/2017 23:04 TRANSFER AGENT
but how come they are not appearing in the user's mailbox?
Any help would be greatly appreciated.