Tek-Tips is the largest IT community on the Internet today!

Members share and learn making Tek-Tips Forums the best source of peer-reviewed technical information on the Internet!

  • Congratulations strongm on being selected by the Tek-Tips community for having the most helpful posts in the forums last week. Way to Go!

Exchange CPU at 100% and unresponsive 1

Status
Not open for further replies.

JonReid

IS-IT--Management
Sep 22, 2003
6
US
Recently, our exchange server has been running at 100% CPU. We have tried just about all of the recommendations, with no luck. Microsoft seems to think it is corruption in the database. We are working on that now.

This is what has typically happened over the last several days. CPU is at 100%, with Store.exe and Services.exe splitting about 90% of that. Early in the AM, Exchange seems to function fine, in spite of this. Sometime between 8:30 and 9:30 (when I expect just about everyone has logged in), Exchange and Outlook become unresponsive. A restart of the store seems to fix this problem. While the CPU quickly spikes to 100% again, Exchange and Outlook run fine the rest of the day, in spite of being at 100%.

Today something different happened. Services.exe CPU was not high and Store.exe CPU was around 75-80%, with at least 20% idle time. But same problem occurred at roughly the same time. So far, the same solution!!

We also have isolated incidents of messages getting stuck in people’s outboxes for days.
 
Our last fix from MS took store.exe to v5.5.2657.74 - fix called Exchange5.5-KB829418-x86-enu.EXE
 
jim7772,

We had exactly the same issue a couple of years ago and opened an incident with Computer Associates. You must not have background scanning enabled, despite what Microsoft says (CA says don't have it enabled). How background scanning works is that everytime there is a signature udpate or a change in the realtime monitor options background scanning starts another background scan, even if one is still in progress. It doesn't take long to max out your CPU, particularly when you have a large number of attachments. Having background scanning disabled means your attachments will take longer to open each time the signature is updated since they will have to be scanned by the new signature before opening.

You also need to do the following:
Refer to It is for v4.5, but the file list (with one correction as below) applies to v6.0 (the registry key/value is wrong, though).

Open up your realtime options, and select filter -> process. Enter each of the EXEs from the list in that tech doc under Exchange 5.5, but note the misprint of ESCUTIL.EXE should be ESEUTIL.EXE.

Save that, open up your mail option. Select log, and change log size to 0, back logs to 1, and log level to 0.

There is one other possible cause. Check the last time the virus signature updated. You must see 4 CA-eTrust events (2 starting the Exchange option and 2 unloading it)in the application log of the server which hosts Exchange. If there are only 3 (2 starting, 1 unloading) then, even though InoculateIT's logs don't indicate it, the signature update to the Exchange option failed and you'll need to reboot the server Exchange is on. Be forwarned, if this is the case then either the Internet Mail Service or Information Store will fail to stop and you'll just have to shut down dirty.

Hope this helps. It worked for us on NT4/SP6a, Exchange 5.5/SP4.
 
Thanks cmeagan656, very informatative reply. We do all of what you have mentioned and background scanning being on has not caused us a problem. The only time we get a problem is when we move mailboxes. I can only assume that as Backround scanning is on and we've loss single instance storage that the av is having a field day checking all the newly moved attachments with the latest signature.
At present all of our 4 servers are happy at 0-10% - leaving us time to try and crak on with migrating to E2K3!! I just hope it is as good as everyone expects it to be !

Thanks again
 
Status
Not open for further replies.

Part and Inventory Search

Sponsor

Back
Top