exchange 2000 problem

[TheHobbit]

_DJ_ said:

That's how to send mail using SMTP, not recieve it using POP3. The problem we've got is that clients cannot retrieve messages. DJ

yeah, see my next reply. thought getting mail in by command line would be useful if he's away from outlook

[_DJ_]

TheHobbit said:

_DJ_ said: That's how to send mail using SMTP, not recieve it using POP3. The problem we've got is that clients cannot retrieve messages. DJ yeah, see my next reply. thought getting mail in by command line would be useful if he's away from outlook

oops, sorry about that . 2 minutes too slow though

edited to add: Us numpty exchange admins use web access when we're away from Outlook!

>> Edited by _DJ_ on Wednesday 7th January 09:47

[TheHobbit]

usually, problems with my e-mail are due to a config cock-up on my linux box, and so no web interface...... command line all the way!

[billb]

after defrag its down to 12gb

you can see the mail but cant open it its v frustrating. do u think it could be anything to do with av software that was put on recently - sophos mailmonitor?

[_DJ_]

yep, do you know how the virus software works (which interface it uses etc?) - I've always used Sybari so am not familiar with that product. I'd be tempted to disable it for a few minutes (and disable the SMTP service on the server so not to get mail for a while) to see if that sorts it. Failing that, is there anyway I could get to see the servers remotely to help you fix it (I you don't want to do that it's perfectly understandable) and if you'd prefer to vet me first I can give you my mobile.

[billb]

[quote=_DJ_]yep, do you know how the virus software works (which interface it uses etc?) - I've always used Sybari so am not familiar with that product. I'd be tempted to disable it for a few minutes (and disable the SMTP service on the server so not to get mail for a while) to see if that sorts it. Failing that, is there anyway I could get to see the servers remotely to help you fix it (I you don't want to do that it's perfectly understandable) and if you'd prefer to vet me first I can give you my mobile.



Thanks for the offer but I do have external engineers looking at it ( we have a support contract with them ) but they dont seem to be getting anywhere and i'm getting rather hassled and worried so am seeing if anyone has any other ideas!

Is very annoying as mail seems to be coming in ok and the queues are clear and theres no obvious errors in the event log. when you go into either outlook or owa after a long time your mail comes up (ie a list of mail with the senders, subjects etc as normal but if you go into any of them it waits for ages and then says cannot open item. doesnt help i'm full of fluey this week i hate computers!!

[pebbledash]

billb said:

after defrag its down to 12gb you can see the mail but cant open it its v frustrating. do u think it could be anything to do with av software that was put on recently - sophos mailmonitor?

I presume the 12GB is for both files for the store, I had exactly the problem you described, a while back, and it was down to trhe store size, the server was dismounting the store as it had reached the maximum size. Microsoft can give a registry key to overcome this limit to allow the situation to be resolved.. my problem is/was caused by users insisting on sending 100MB atachements..

The problems with users archiving there own mail to PST etc is that it then ends up outside the backup policy and they have even been known round here to delete (that big file as they put it) when there hard disk fills up.

the best product I have found can be found at www.attachstor.com it removes all atachements to a file store and then links it to the e-mail, its works with outlook and outlook web, which is nice, and saved me arround 60% of my total mail space, total disk space saving was 50% including the extracted atachements which ar then zipped up. (they do a STORveyor Lite product to analyse stores if you are interested.)

also i use Policy Patrol from Red Earth software on my Exch 2003 Box and have enabled it to ZIP up all atachements and reattache them for ALL ove 1Mb and it is amazing how much space this saves

[_DJ_]

OK, no problem. It would obviously have been gratis as you're a Pistonheader but I can understand you not taking the risk, especially when someone's already on with it.
I would say that virus scanning would be a highly probable cause. The messages would probably only be scanned when messages are read/written, which would explain why you can see a list of folders/messages but not retrieve them.
Failing that, a corruption in the mailbox store. Is new mail being delivered to the stores (you should be able to check this by checking the queue lengths)? Can you get any stats from the virus engine (such as how many messages scanned etc)? Is the number incrementing?
Exchange 2000 logs very little by default in the event logs. You could really do with enabling some more diagnostics logging to get more information about what's going on (using Exchange System Manager).

Darren.

[_DJ_]

The limit is 16GB, so if the combined file size of the EDB and STM are <16GB you should be OK. The article you were referring to (to increase the size) is documented here:
http://hellomate.typepad.com/exchange/2003/09/temporarily_inc.html

Could be worth a shot.

edited to add: Pebbledash: Didn't the store dismount and log an error in the event log (it's been a while since I've seen this happen)?
DJ

>> Edited by _DJ_ on Wednesday 7th January 10:50

[billb]

_DJ_ said:

OK, no problem. It would obviously have been gratis as you're a Pistonheader but I can understand you not taking the risk, especially when someone's already on with it. I would say that virus scanning would be a highly probable cause. The messages would probably only be scanned when messages are read/written, which would explain why you can see a list of folders/messages but not retrieve them. Failing that, a corruption in the mailbox store. Is new mail being delivered to the stores (you should be able to check this by checking the queue lengths)? Can you get any stats from the virus engine (such as how many messages scanned etc)? Is the number incrementing? Exchange 2000 logs very little by default in the event logs. You could really do with enabling some more diagnostics logging to get more information about what's going on (using Exchange System Manager). Darren.

Mail seems to be coming in fine and in fact i have just set up some diversions on our main people to divert to an internet address and that seems to be working ok so exchange looks fairly healthy.

If you try and go into the sophos program it says that another program is alreay running and asks you to switch to it so you cannot get into it which is what has made me suspicious of it. i have told our support people about this and they said they will look at that amongst other things. caught in a situation where i want to play with it but as we have the support i want them to try and fix it as in theory they should know more about it than me.

would a corruption in the mailstore be highlighted by running the isinteg commands as they all came back 100% OK?

[_DJ_]

If mails is hitting the store then it's obviously not dismounted and the IS service is still running. Corruptions in the store should be spotted by either ISINTEG or EDBUTIL/ESEUTIL. However, I've never seen an Exchange database that opens and yet noone can read any messages, it's usually more localised. My hunch is still the virus product. Could you check the file sizes and makes sure you've not hit 16GB (including both files).

edited to add: The mail that you're redirecting will never hit the store (it's processed before that). However, if the queues are empty you can safely assume the messages are being delivered (another way to check would be to check the database sizes - you defragged and shrank them previously so they should increase in size continually as noone can get in to delete mail).
Darren

>> Edited by _DJ_ on Wednesday 7th January 10:58

[pebbledash]

_DJ_ said:

edited to add: Pebbledash: Didn't the store dismount and log an error in the event log (it's been a while since I've seen this happen)? DJ

it Did but i dont think the error logged was "store dismounted as its too big" it was a little less obviouse but it was a while back..

[pebbledash]

Just a thought. What is in the Log directory, I had a server once that was running like an absolute DOG, I traced it to the fact that the backups had been failing for a week or two (I had be away on holiday) and the log directory had about 500Mb+ in it, once the full backup ran and commited/flused the loggs it was back to full speed.

[_DJ_]

pebbledash said:

Just a thought. What is in the Log directory, I had a server once that was running like an absolute DOG, I traced it to the fact that the backups had been failing for a week or two (I had be away on holiday) and the log directory had about 500Mb+ in it, once the full backup ran and commited/flused the loggs it was back to full speed.

He did a full backup a few days ago (check start of this thread), which would have cleared the transaction logs....

[pebbledash]

_DJ_ said:

He did a full backup a few days ago (check start of this thread), which would have cleared the transaction logs....

I did read that, but it could be worth a check. its such a simple thing to just look in the directory, it seems silly not just to check and make sure.

>> Edited by pebbledash on Wednesday 7th January 11:21

[billb]

will look in a min theres a remote engineer on there at the mo

[billb]

ITS WORKING!!!!


alllieluiah!!

it was the soddin anti virus program. reinstalled that ( against the advice of our support company i might add! ) and it works fine (touch wood)

bloody sophos

thanks for all your help guys its nice just to have people to bounce ideas off and get advice from in moments of computer crisis I appreciate it.

off to drink beer and lemsip

thanks

[pebbledash]

billb said:

ITS WORKING!!!! alllieluiah!! it was the soddin anti virus program. reinstalled that ( against the advice of our support company i might add! ) and it works fine (touch wood) bloody sophos thanks for all your help guys its nice just to have people to bounce ideas off and get advice from in moments of computer crisis I appreciate it. off to drink beer and lemsip thanks

Result...

The Sophos product does use the AV API built into exchange, rather that its own way doest it not..

[_DJ_]

pebbledash said:

billb said: ITS WORKING!!!! alllieluiah!! it was the soddin anti virus program. reinstalled that ( against the advice of our support company i might add! ) and it works fine (touch wood) bloody sophos thanks for all your help guys its nice just to have people to bounce ideas off and get advice from in moments of computer crisis I appreciate it. off to drink beer and lemsip thanks Result... The Sophos product does use the AV API built into exchange, rather that its own way doest it not..

Excellent news!

Sophos does use the native API's (the only product that doesn't is Sybari) There's actually no reason not to anymore since Microsoft have fixed the rather large hole in v1 of the API for e2k.

Darren

[TheHobbit]

of course, not having an AV product installed directly on the server removes these problem. to avoid a shameless plug, and risk breaking the rules, I will simply say that I work for an e-mail security company that sorts AV, anti-spam, anti-porn, content filtering etc at the internet level, removing the worry of patch updates etc from your mail infrastructure

this does *not* mean you should not have AV protection on your workstations to prevent virus infiltration from floppies/cds etc