Exchange 2003

[biggal]

Had a strange occurrence yesterday. I ran the latest security updates and bounced my Exchange Server. The last reboot was back in Dec 2006. The Server came back up without errors. I figured all was Ok until I began to get
calls from my users saying that they had received emails from "System Admin" undeliverable: and that they were from some emails that they had originally sent back in Dec-Jan-Feb-....

Here's an Example:
Your message did not reach some or all of the intended recipients.

Subject: APPLE COMPUTER
Sent: 1/9/2007 12:19 PM

The following recipient(s) could not be reached

------------------------------------------------------------
The emails were successfully sent to the recipients after I rebooted.
Anybody see this before ?

 

[ShackDaddy]

Sounds like your backups might not be done using an Exchange-aware backup. Have you had a big pile of transaction logs in your mdbdata directory? Normally what happened to you can happen when old logs get replayed into the database after a reboot. A good backup normally purges these logs. Having old logs on hand indicates that your backups aren't truncating (playing against the db and then being purged). What tool are you using for backups?

ShackDaddy
Shackelford Consulting

 

[biggal]

Thanks for your reply ShackDaddy ....
I am currently using CA ArcServe 11.5 on a Windows 2003 Server w/Exchange 2003 and run a Full Daily Backup Job to a Dell 128T LTO-2 tape Library.

 

[ShackDaddy]

So how many files are in your mdbdata directory?

ShackDaddy
Shackelford Consulting

 

[biggal]

The mdbdata directory currently has 218 objects (94GB)

pub1.edb = 28GB
priv1.edb = 24GB
pub1.stm = 22GB
priv1.stm = 21GB

all other logs are dated today 3/9/07 with the exeption of:

tmp.edb = 3/6/07
isinteg.pri = 3/6/07
caief8a.tmp = 12/15/06
res1.log = 6/10/2004
res2.log = 6/10/2004

 

[ShackDaddy]

That looks great. Well, it doesn't look like it's a backup issue.

Here's my best guess: Sometimes a 3rd party mail addon that processes mail fails to delete an item in the mail queue after delivery/processing, but it keeps a data cache of items that have already been dealt with. If the server reboots, the cache is cleared and the app "finds" the mail again and processes it. I'm sure that some variation on this theme took place. Could have been an AV-screening tool, or it could have been a compliance app, but it was likely something tightly integrated with your server. Maybe it was even the local SMTP engine.

ShackDaddy
Shackelford Consulting

 

[biggal]

Excellent point!
There is another player in this scenario. We have a Gateway Server running Computer Associates eTrust Antivirus for the Gateway 7.1.