exchange 2003 freezing 2

[CEChriss]

I am experiencing my exchange 2003 freezing at irregular intervals. What happens is that the mail stops flowing both directions, in and out.

When I look at the event logs the are no error msgs.

Since there are no errors and all services are running, I restart the server. This fixes the isssue and the exchange 2003 starts working.

Now when I look at the error log it shows that the application log is full, acually it states this during startup. I empty the log works fine until the next time.

My question is could log being full cause the ecchange 2003 server to freeze up. If so how should I configure the log, so this does not happen.

thanks Kevin

 

[snootalope]

I'd set your log to be like 5mb or something and then set it to over write as needed. Your machine isn't freezing cause the even log is full, it's something with exchange or your network.

After changing those log settings, go into your system manager and set your SMTP (MTA) logging to Medium or Maximum so you can see what's going on with the messages and why they are stalling in the first place.

Also, keep a close eye on your Queues in the system manager as well. They can tell you alot.

What kind of machine are you running this on? New server? CPU? Memory? Network speed?

2003 is a beast and it the more nuts you got driving it the better...

snoots

 

[CEChriss]

Thanks for the help and quick response.

I am running windows 2000 sp4, on a dual processor server (p-4 1000Ghz)with 1 gigabyte of ram. I has a gigabyte throughput from server to network and 100 Mb to the internet

Can you give more instructions on the SMTP(MTA) I went to where I though you were talking about and did not see any settings refering to medium or Maxium.

I have looked at the queues and and they have not told me much What shoudl I be looking for in the queues.

Thanks for the help Kevin

 

[snootalope]

Just so you know, we're running server 2k3 and Exchange 2k3 on a dual 3.2GHz machine with 2gb of ddr, and it's currently unitilizing 50% of available RAM. We'll probably be uping that to at least 3gb here shortly..

Anyhow, open your System Manager and expand Administrative Tools, then "your Site", then Servers, and RIGHT CLICKY on your server and hit properties. There should be a diagnostics logging tab at the top. Clicky on MSExchangeAL in the box on the left and the set the min-max log settings on each one of the options at the right!

The queues will give you an idea of what connections are active to your mail server from remote domains, the messages, the sizes, the times they were submitted, senders, bla bla bla.. they'll tell you everything that's going on as soon as it starts to slow down.

Also, if i were you, i wouldn't run anything except exchange on that machine. Nothing. I'd install the system manager on my local machine (by doing a custom install of exchange 2k3, it's easy) Hopefully you got XP or 2k on your personal machine..

 

[CEChriss]

Thanks
I am not currently in front of the server, so I can not check all the items as you suggested. I will do that this weekend or monday.

As I remember, the queues did not give the information. Are the queues you are talking about under the mailbox object. A better question would be, where are the queues you are talking about located

I am a newbie to exchange, in case you have not figured that out.

Kevin

 

[snootalope]

In the System Manager; Under Administrative Groups | Your Site | Servers | *Your Server* | and there should be an object under your server name that says Queues.. That's your current mail delivery connections, or queues.

 

[CEChriss]

Okay, We are on the same page. I guess I do not know how to read the informatin there. I look at it but do not know what it is telling me.

How can I figure it out.

Thanks for the help

 

[snootalope]

Well, most importantly, you got the remote domain that your mail server has connected to before sending the queued message. Over on the right, you can see the number of messages and the size of them. Those can help you see what messages are actually sitting in the delivery spot at any time.. I'm not saying watching the queues are going to help you completely solve your problem, but it's good info to know when the machine starts to croak.

Also, did you get that logging stuff figured out? Don't forget to set your log size to be extra big, like 5 or 6 megs or something.. Those are what's going to help you out the most when trying to solve these kinds of problems..

snoots

 

[CEChriss]

Yes, I set the log size at 10Mb and to over write as needed. The exchg server went down over the weekend when no one was on the network. My guess is that that eliminates the not enough resource issue. Anyone have any ideas.

Thanks ahead of time

Kevin

 

[snootalope]

What did the event logs say?

There should at least be a "...the last shutdown was unexpected.." message in there with event ID source: eventlog

That should give you an idea of what time it went down and what not.. then, check out what happend before that, what processes did what, is there any errors logged? What do they say? If there's no errors, it's possible that it was some kind of STOP error and it blue screened..

See what you can find.

 

[CEChriss]

thanks for your reply

Actually the first few times it happened there was nothing in the logs. The server actually did not go down, rather the exchage server stop processing emails and/or responding to the outlook client. The last time though there was something in the system log. It appeared from the error that it was not find a server to update it's time. I used the net command and set to receive time from an atomic clock site. So far ther has been no repeat of the unresponsiveness(sp). It was never regular in occurance of I am holding my breathe and sitting on pins and needle to see if it repeats.

Thanks Kevin

 

[CEChriss]

Well, I have some more information. It appears what is happening is that the informatin store service is stopping. If I restart that service, the exchange starts working perfectly and all is right with the world. Mine at least. I have not been able to deduce what is causing the service to stop. Is nothing in the logs. Does ayone know a method of monitoring this service.

Can the backup have anything to do with this. It is not my first choice as the the backup runs 5 night a week and this problem happen once or twice a week.

Thanks ahead of time for your help

 

[CEChriss]

Well, over the weekend I believe I discovered the problem. It was the antivirus software.

Thanks everyone for all your help!!

 

[dogsbod]

what anti virus were you using, was it scanning files that should of been excluded? I'm in the process of upgrading and trying to cover msot eventualities

 

[CEChriss]

Sorry for the long wait for an answer. I was using Computer Associates. It was scanning files that should have been excluded. Both in winnt and exchsrvr, let me knkow if you need any more help in this matter. Like what files should be excluded.

 

[Kahlor]

I am interested in knowing what files you excluded. I have had the same problem and I am using McAfee for anti-virus.

Thanks

 

[CEChriss]

I excluded the exhcsrvr folder on the exchange server and winnt folders on all servers.

excgsrvr folder is located under "progam files" folder

hope this helps

 

[xmsre]

For McAfee -

http://service1.symantec.com/SUPPOR...256e4a005c3cf0&dtype=&prod=&ver=&osv=&osv_lvl

You don't neet to exclude the entire winnt forlder, just \winnt\system32\inetserv

 

[CEChriss]

Thanks xmsre
Xmsre is correct you only have to exclude the inetserv under the \winnt\system32
Thanks for the catch xmsre


good luck