Exchange 2003 pre-submussion qeue sticking? 1

[jhaudio]

First off, I am a very competent in the desktop support arena, but unfortunately I know enough to be dangerous when it comes to server administration. Unfortunately for me, I am stuck temporarily in this possition, so bare with me...


My company is running Exchange server 2003 (6.5.7226.0) on a windows 2003 (SP1) server. Everything has been running fine for months (with the exception of loss of internet service from Cox business). Suddenly, about a week ago, the mail server started experiencing extreme delays.

Mail is getting stuck in the "messages pending submission" qeue. I followed steps found in similar postings and disabled GFI mailessentials (version 11) by stopping all of the GFI services), and stopped the mail scanning portion of McAfee VirusScan Enterprise 8. I then restarted, but the problem still exists (approx 5000 e-mail backed up in qeue).

I finally got the mail to start pumping again (although slowly) by using iisreset. It will send a few mails, and stick again.

I did get the qeue down before the weekend, but again Monday morning, when the traffic bumped up a bit, it went right back up (about 95% of the 5000 mails is spam, coming from hundreds of different sites... GFI has done a fantastic job of blocking by the way).

I can get it down by continuously using iisreset (I actually set a task that runs iisreset every two minutes).

This is a nasty band-aid of a fix, and I have been banging my head against the wall here trying to find the solution.

To make it more difficult... for some reason I am unable to turn on diagnostic logging for the mail server. It is just greyed out... if I could get it on, it might lead me to the real problem.

Right now GFI, and McFee Enterprise 8 are both running, and a task is running iisreset every two minutes... mail seems to be moving much better... but I know that resetting the iis service like that is going to cause SOME kind of problem.

Any ideas, information, or advice would be incredibly helpful! Thanks in advance guys!

 

[ShackDaddy]

MailEssentials is known to have this issue, since even the latest versions aren't supposed to be able to process more than 2 emails per second.

There are a couple of options. I believe there are some options within the MailEssentials console that take more of the engine's time than others. I recently worked on a server with exactly this problem, and I turned off all the DNS Blacklist options, sender domain validations and the UIR Realtime Blacklist. The didn't have fast enough DNS resolution for those to be realistic tools, and it's a common problem for MailEssentials users. I also checked the blocking log and noted that most of the spam was coming from four different IPs. I blocked those specific IPs from within the Exchange System Manager, and the volume of incoming spam slowed greatly, enough for the system to catch up and get down to a presubmission queue of zero.

Your other options is to use a service like ExchangeDefender which processes all your mail for you on their servers before it actually hits your mail server. I'm beginning to roll that service out for my clients, and it's very effective and head-ache free. That costs about $3/user/month. SpamSoap is a competitor who also has a good service.

ShackDaddy
Shackelford Consulting

 

[jhaudio]

Thanks for the response!

I have seen that in some posts... but what I dont understand is that it did not seem to start clearing when I disabled GFI.

I did not simply turn off the individual filters... I actually stopped the three GFI services, set them to manual start up, and rebooted without them loaded, and the problem still seemed to persist.

Is there a something I am missing? Does GFI have some hidden service/process that is still trying to process the mail (or more likely would the server be WAITING for the mail to be processed by GFI before delivering to the next qeue stage?)

I just dont know how the flow of mail works from the point of being in the pre-submission qeue until it gets delivered to the local delivery (or other) qeues.

Thanks again!

 

[ShackDaddy]

Just being installed, not even running, GFI's event sinks cause mail to wait in the presubmission queue. Only MailEssentials has the ability to move things out of that queue, so don't turn it off!

If you want to see that presubmission queue empty very quickly, just remove the GFI software!

Really, the best way to clear that queue is to reduce the number of things that MailEssentials has to do to each mail item to consider it "processed".

ShackDaddy
Shackelford Consulting

 

[jhaudio]

Thanks again for the information.

You are correct. Since the vast majority of the spam that we get is directory harvesting, I moved that scan to be the first scan that is run, directly after all of the whitelisting. I also lowered the scans that run DNS query to the end of the scan, so a far smaller amount of mail will get to that point, but the filters will still be in effect. That seems to have gotten everything flowing well without removing the added scan levels.

If we experience other issues, I will follow the rest of your advice, and start removing some of the other filters.

Thank you very much for your very knowledgable and helpful advice!

 

[ShackDaddy]

Welcome to Tek-tips, jhaudio. I'm glad I was able to help you get things sorted out.

In the future, a great way to show appreciation to a helpful poster is to click the "Thank %helpfulperson% for this valuable post" link. I'm not asking that you to do that for this post, but I know that other people who help you out in the future will appreciate getting stars. I guess it's substitute for cash, beer or chocolate.



ShackDaddy
Shackelford Consulting

 

[ACARSB]

I had the same problem with a Windows 2003 SP1 server, Exchange 6.5 and GFI Mail Essentials 11.0

Disabling the disclaimer function in GFI resolved the problem for us. The Queue didn't get stuck anymore.

I hope this problems will be resolved in the new GFI Mail Essentials release.

 

[nhbilly]

my queue gets clogged up sometimes and usually an iisreset clear things up but have no idea what is causing the problem.

so any other ideas?