When i tried run the EXmon troubleshooting assitant . It say found one performance error , however the username is "?" and the IPs is my frontend servers IP . Is it normal ? I tried check the mapi client version but no luck as well .:
"The user '?' was issuing 74.51 MAPI operations per second, which is higher than expected. If a user is issuing more than 10 operations per second for a more than a few minutes at a time, this usually indicates that they are running a resource-intensive
application. MAPI client versions: 2050.33069.0. User's IP Addresses: 172.30.xx.xx(Frontendsvr1 IP ), 172.30.xx.xx. (Frontendsvr2 IP) "
Secondly , let say we found an users is trigger high RPC operation . How do we specifically stop that users activity ? Any way to do that ?
It is performance related issue. Based on my research, it might be caused by the cluster replication, antivirus applications, or firewall. It is best
if you collect a performance monitor log for further analysis.
Update - Microsoft Exchange User Monitor (Exmon) tool - Updated Version
It ring a bell that it could be an application call exclaimer which will query AD server and we used it for disclaimer . But how do i further verify it ? Im actually already using EXmon to capture the logs already .