locked
Exchange 2007 Transport Service crashes on Dedicated HUB/CAS server and displays event 629, 623, and 17017 RRS feed

  • Question

  • Hi,

    Our transport service crashes and cannot be brought back up until the mail.que file is moved off and another one created. This has happened twice - once yesterday and again today at about the same time in the morning on one of our dedicated hub/cas servers.

    The Windows event log application shows a Warning ESE event id 629, then within 2 minutes Error ESE 623 Performance, then finally an Error ESE 623 Transaction Manager. I cannot find any reason on the support sites, and as stated this just started happening. It has been in production after for over 2 years has all the latest updates and is rebooted weekly. Any suggestions are appreciated.

    Thanks

     

    Wednesday, August 10, 2011 7:18 PM

Answers

  • Hi,

    I suggest taking the following steps:

     

    Backup Queue folder

    Stop Transport Service

    Ran eseutil /mh against mail.que on the production folder to verify if it’s a dirty shut down status.

    Ran eseutil /p on mail.que, to repair the database

    Remove all other file in Queue folder except repaired mail.que

    Started Transport Service

    Force the queue to connect and test the issue.

     

    Eseutil

    http://technet.microsoft.com/en-us/library/aa998249.aspx

     

    Thanks,

    Simon

    Sunday, August 14, 2011 5:26 PM
    Moderator

All replies

  • any anti-virus installed on the server? 3rd party add-ins?

    Why is it rebooted weekly?

     

     

     

    Wednesday, August 10, 2011 7:21 PM
  • We use Symantec Endpoint Protection but do not scan any of the Exchange directories or log files as per MS recommendations.  Rebooted on weekends as part of our maintenance schedule. No other third-party software and besides all of this just started happening yesterday without any changes to software.

    Wednesday, August 10, 2011 7:43 PM
  • Ok, be sure to exclude any process scanning as well:

    http://technet.microsoft.com/en-us/library/bb332342.aspx

    Its always possible that something changed in an A/V signature or update, but assuming that is not the case and there is no obvious smoking gun, I would consider simply building a new hub trans server - virtualized or otherwise, and then removing the HT role on the CAS and re-adding it if you want. Sometimes its easier to simply rebuild then spending too much time trying to determine the cause. Especially since you can bring up a new HT server rather quickly.

     

     

     

    Wednesday, August 10, 2011 7:51 PM
  • That may be fine for most organizations, but rebuilding is not an option for us right now. I would like to get to the real reason this is happening. If anyone else can chime in I would appreciate it since sometimes calling MS support leads you off to far away lands with little or late answers...
    Thursday, August 11, 2011 1:00 PM
  • Oh, one more thing. The mail.que file grows to very large sizes over 5 GB from one day to the next. I still have not found the root cause. Our internal message limit is 50MB for email attachments as well as for the hub transport.
    Thursday, August 11, 2011 2:31 PM
  • Hi,

    I suggest taking the following steps:

     

    Backup Queue folder

    Stop Transport Service

    Ran eseutil /mh against mail.que on the production folder to verify if it’s a dirty shut down status.

    Ran eseutil /p on mail.que, to repair the database

    Remove all other file in Queue folder except repaired mail.que

    Started Transport Service

    Force the queue to connect and test the issue.

     

    Eseutil

    http://technet.microsoft.com/en-us/library/aa998249.aspx

     

    Thanks,

    Simon

    Sunday, August 14, 2011 5:26 PM
    Moderator