Exchange slows/Stops & Store.exe uses high CPU

[Flashgordon]

Hi All
We've got an annoying new problem that started last week.
The exchange 2003 system will slow down and then a few minutes laster stop responding completely, with store.exe on the server showing exactly 50%. I believe this may be really 100% but as we have dual-processor, it's dividing it by 2. I have no idea what is actually causing this but it happens everyday and only a server reboot will cure it.
I have a feeling it might be something to do with Sophos mailmonitor as we installed a new version of this last week. Can anyone shed some light on this?
thanks
Andy.

 

[jemckinney]

I was just getting ready to ask if you had some sort of anti virus program running on the server. have you noticed that these slows down happen at the same time? if so, look and see what you have scheduled to run at that time. see what active processes are running on the server also. we use sophos also and had a problem with it running on the server. we shut off the ic client and only run it late at night in case this happens. as far as mail monitor, check it's settings and see what runs at the time of the beginning of the slow down. Oh, have you also checked the event logs? they may also shed some light on your problem.

I hope this helps.

 

[Flashgordon]

Unfortunately, these slowdowns don't coincide with any scheduled scans, that would be too easy. IC Client shouldn't be running on the exchange server, only a SAV client. That's Sophos' advice.
Yesterday I turned off Information store scanning, only left on real-time mail scanning, and so far so good, but it's not even been 24 hours yet.
Andy.

 

[daviesda]

I remember we had a very similar problem with exch2k3 and sophos mailmonitor. We eventually turned off the background and the active scanning for the public and private stores and just left it so that the mail scanning part of mailmonitor took care of protecting the server.

I did hear a rumor from a guy who worked on a support desk that the cause of the problem was in dispute between sophos and Microsoft and they were both blaming each other. I can't substantiate this though

Just having the SMTP mail scanning has been fine for us so far. Approx 5 months. I suppose it just depends on whether you are happy your stores are virus free to start with.

Dave

 

[daviesda]

BTW quite a few people are talking about this here

http://www.experts-exchange.com/Networking/Email_Groupware/Exchange_Server/Q_20961199.html

it seems that sophos were working on patches in may - i will try and find out if they managed to get it working.

David

 

[luisrato]

I think that could be one Antivirus issue. I had the same problem too with the Groupshield 6. Only the last update of groupshield has done anything to solve that type of problem.

If you have support from sophos, try to submit one case. There may be some kind of a new patch.

Luís Rato.

 

[Flashgordon]

Well, it's been nearly a week and everything's running fine since I turned off IS scanning. My Virtual memory largest block size has also remained stable, which is another problem we had now solved!
Andy.