Store.exe 98%CPU & won't respond. Help!

[numanager]

I'm running E2K-SP3 on W2K-SP3 DC. Yesturday, it slowed to a crawl in responding to Outlook and is still there. I've turned off Virus Scanning, but that didn't help. It will take up to 5 minutes for Outlook to come up when usually is was 2-3 seconds! Store.exe won't close from "Services". The only way to stop it is with 'Kill' from the DOS prompt.
But Store.exe will release CPU to other processes, as I can run other programs on that server without delays. This sever runs IIS for our Intranet, which comes up like normal, so network connections are fine.

I've re-booted several times, including cold boots.
I've run eseutil to recover, defragment and check integrity. Everthing looks fine.

Any suggestions?

 

[xmsre]

What's in the application log?

 

[numanager]

Nothing of any use.
Process start, process shut down.

The only error (Warning) is one we've always gotten:

SceCli Event 1202.
Security policies are propagated with warning. 0x534 : No mapping between account names and security IDs was done.

We've been operating for 2 months on this version on this server.

 

[xmsre]

Anything in the queues?

A corrupt message in the queue could cause high CPU utilization. If you don't have the pst-SP3 rollup installed, a deeply nested message fron an outlook client can also cause high store.exe CPU.

 

[numanager]

No the Queue is clear.

 

[xmsre]

You'll probably want to download AD plus, and take a user mode dump. Going through the active threads should explain what's using 98% CPU.

 

[DarkHat]

Anti-virus?
If you run a Anti-virus on your server. Stop it and see if you still have the problem...

 

[numanager]

Thanks for your help.

After 4 hours on the phone with Dell Tech support, we found the problem was too many Exchange log files. Our backup wasn't causing Exchange to roll up and clear the log files, so they accumalated until the Information Stare couldn't handle anymore (600 files in our case).

The solution was to run eseutil in recovery mode, then delete all the log files in the the MDBDATA folder.