none
MSExchangeTransportLogSearch.exe eating my memory

    Dotaz

  • Hi.

    Im new to MsExchange, and have ran into a issue I hope explanation on. I couldnt find same issue when searching around.
    The exchange server is used for private usage, number of mail accounts is <15. Reason I use it is to be able to educate myself using serversolutions included MsExchange since Im not able to educate at a university.

    I got a MSExchange Server 2010 installed on a WinServer2008r2 with 4gb memory installed (for now).
    When troubleshooting on a mail-issue from a forum-site I got, I got "spam-attacked" through my mailservice.
    over 80'000 e-mails were routed through my mail-server.
    I fixed the restrictions so I werent spammed anymore, but it were after this the memory-issue came.
    Before the issue I had around 400-500mb memory free on the server. But now MSExchangeTransportLogSearch is eating my memory.
    I have rebooted the server. When I kill the process, it comes back as expected. I killed it to see the memory eating.
    It graduatly starts eating. The memory usage just keeps rising untill there are no more memory for it to eat. It stops on aprx 3'600 mb memory.

    Hope for a explanation on why, and a fix for solution the issue.
    I also run other server-application on the same server, such as iss. So this issue makes it hopeless for me to use the server for anything else then Exchange..

    Best regards - Knut Arne

    10. června 2012 20:54

Všechny reakce

  • Are there still messages in the queues?

    Regardless, since this sounds like a test server, you could try stopping the MSExchangeTransport service, rename the database ( or delete it) and restart the Transport service. It will recreate the database, rename any unwanted logs ( event log events will fire if it does that) and start you off clean.

    10. června 2012 22:14
    Moderátor
  • I managed to get rid of all messages in queue.

    This is a test-server, but the data lying on the server are not test-data. I use the mailboxes in msexchange for my mail.

    Ive now stopped the MSExchangeTransport service and renamed the mailbox database lying in: EMC -> Organization Configuration -> Mailbox -> Database Management.
    Started the service again.
    Nothing happend. It didnt make a new folder or rename old folder in 'C:\Program Files\Microsoft\Exchange Server\V14\Mailbox\'
    It still uses the same path as last time (wich now contains 1890 log-files)
    If I delete this database, will I loose all data/e-mails that are in my mailbox'es?

    I See that the function of the MSExchangeTransportLogSearch.exe is only to generate Message-Tracking Logs and Transport Logs search.
    I guess it try's to generate logs for the 80'000 mails I deleted. Isnt there a way to "Blank out" its queue?
    Though is this service a nessesary service for MSExchange? Can I just stop the service and put it to manuall, and activate it manually if I need it?

    11. června 2012 12:16
  • I managed to get rid of all messages in queue.

    This is a test-server, but the data lying on the server are not test-data. I use the mailboxes in msexchange for my mail.

    Ive now stopped the MSExchangeTransport service and renamed the mailbox database lying in: EMC -> Organization Configuration -> Mailbox -> Database Management.
    Started the service again.
    Nothing happend. It didnt make a new folder or rename old folder in 'C:\Program Files\Microsoft\Exchange Server\V14\Mailbox\'
    It still uses the same path as last time (wich now contains 1890 log-files)
    If I delete this database, will I loose all data/e-mails that are in my mailbox'es?

    I See that the function of the MSExchangeTransportLogSearch.exe is only to generate Message-Tracking Logs and Transport Logs search.
    I guess it try's to generate logs for the 80'000 mails I deleted. Isnt there a way to "Blank out" its queue?
    Though is this service a nessesary service for MSExchange? Can I just stop the service and put it to manuall, and activate it manually if I need it?

    No no. Not the mailbox database, the hub transport database (mail.que)

    11. června 2012 13:18
    Moderátor
  • Have stopped the service and renamed the queue-folder 'C:\Program Files\Microsoft\Exchange Server\V14\TransportRoles\data\Queue' to "Queue.old".
    The mail.que file were on 827mb. The new one that were generated is on 8mb so a bit better.

    I restarted the server. But the memory-eating still persist.
    The server have been online for one hour, and in that time, the MSExchangeTransportLogSearch.exe have eaten aprx 3.5gb of memory.
    While it "eats" it uses 50% of my CPU. When it cannot eat more, the CPU usage falls to 00-01%.

    So same error.. Suggestoins?

    11. června 2012 15:18
  • Hi ,

    This service is installed on the Hub Server, Edge Server and Mailbox Server Role. This is an optional service set to manual only on Edge Server. This service is dependent on “Microsoft Exchange Active Directory Topology Service” on Mailbox and Hub Server. For Edge Server it is dependent on “Microsoft Exchange ADAM”

    Please check if it has any error in Event Viewer on HUB. Such as 7001 & 7002  

    This service’s functions:

     Message Tracking logs are generated.
     Transport logs searching.

    Please check if it has many message be sent.

    And please also check the maximum size of the message tracking log directory and post here. Maybe it has too big search range.

    Related article for your reference.

    Configure Message Tracking:

    http://technet.microsoft.com/en-us/library/aa997984.aspx

     


    Wendy Liu

    TechNet Community Support


    14. června 2012 5:20
    Moderátor
  • Hi.

    Ive checked the Event Viewer, and didnt find any error's such as you show to.
    The only one I found that were close, were a errorID 7004 on MSExchangeTransport: "The activation of all modules took longer than expected to complete. "
    Logical I think this is because the server didnt have enough memory.

    I have deleted the mail's that were in queue, so there are not any messages waiting to be sent.

    When it comes to the maximum size of the message tracking log directory, I cant figure out what it is configured on.
    I havent altered any preferances there. The guide you show to, and I found on searches, only explain how to set a new limit. Do you have a command for showing the limit that is now?

    In: %Programdirectory%\Microsoft\Exchange Server\V14\TransportRoles\Logs\MessageTracking
    I found multiple logs. 19 of them wich are from the spam-attack are on 10245kb, so if these are the logs that are generated, I expect the limit is on 10mb (if I think right?)

    --
    Knut Arne

    14. června 2012 17:44
  • Hi ,

    This limit only reduce the search range when search message log.

    If MSExchangeTransportLogSearch.exe eating your memory not in search of log.

    If possible, you can also try to disable Message Tracking and test.

    I recommend you run Exchange BPA to test its healthy and connection with AD.


    Wendy Liu

    TechNet Community Support

    15. června 2012 3:11
    Moderátor
  • Hi again, sorry for late reply.

    Ive run the Exchange BPA, and found no errors related to this issuer (Only error since I use a SSL Wildcard Certificate).
    I have disable the Exchange Transport Search Log service for now, so I dont have memory issue on the server. Im gonna use some days to read up about the Exchange server to get better understanding around the solution.
    So this thread can be put on ice untill further notice.

    Thanx for the suggestions.

    18. června 2012 18:23
  • I'm having the same issue.  Has anyone come up with a solution?  

    Thanks

    11. července 2012 15:48
  • And I'm having the same problem with my Exchange 2010. Anybody please help...
    • Upravený Misiek69 6. srpna 2012 16:36
    5. srpna 2012 18:16