none
Is iOS6.1 causing Excessive logging? Anyone Else See this?

    Question

  • iOS6.1 was just released.  And of course my apple lovers jumped right on it.

    It may be a fluke, but something to watch for...

    I had a user upgrade to 6.1 and immediately after he finished, his phone/IPAD started causing excessive logging on the exchange server.  

    I found the problem by using exmon and saw the CPU utilization in conjunction with high session count.

    He shut down Outlook and the problem remained.  He Turned OFF his IPAD and the problem went away.  The only change he said he made that morning was upgrading to iOS 6.1

    I'm looking thorught the IIS logs and will re-enable his devices temporarily today to gather some logging.  I will report here what I find. 

    His device caused over 50GB worth of logs for that particular database.


    Bobby Pendino

    Thursday, January 31, 2013 4:24 PM

Answers

  • Please read the KB that Andy posted above.  I'll paste it here so the URL is visible

    http://support.microsoft.com/kb/2814847

    There are some workarounds listed in the KB, and the Exchange community is also active on this issue on Twitter so you may want to keep an eye on the #MSExchange and #Exchange 2010 Twitter feeds.  Please carefully review all content that you may see on Twitter/Internet and test in a lab prior to making production changes.


    Cheers,

    Rhoderick

    Microsoft Senior Exchange PFE

    Blog: http://blogs.technet.com/rmilne  Twitter:   LinkedIn:   Facebook:   XING:

    Note: Posts are provided “AS IS” without warranty of any kind, either expressed or implied, including but not limited to the implied warranties of merchantability and/or fitness for a particular purpose.

    • Marked as answer by BPendino Thursday, February 14, 2013 2:24 PM
    Tuesday, February 12, 2013 1:47 PM

All replies

  • Yes, I have seen this with IPADs. Recreating the mail profile has fixed the issue so far.

    Thursday, January 31, 2013 8:36 PM
  • Had another one upgrade their phone and now their phone won't authenticate.

    Another IPAD was udated, and it says it's connected but doesn't retrieve any data.

    Thanks Apple!


    Bobby Pendino


    • Edited by BPendino Thursday, January 31, 2013 8:55 PM
    Thursday, January 31, 2013 8:54 PM
  •  Hi Bobby,

    We are seeing this exact issue, have you managed to find any workarounds? Do you know if Apple has acknowledged the issue?

    Thanks,

    <city w:st="on"><place w:st="on">Bryan</place></city>

    Wednesday, February 06, 2013 10:38 AM
  • Hi Bryan, deleting and recreating the mail profile as worked for us so far. Not sure Apple is aware of this.\

    Here are the issues Microsoft is tracking:

    Current issues with Microsoft Exchange ActiveSync and third-party devices


    Twitter!:

    Wednesday, February 06, 2013 12:15 PM
  • Thanks Andy.

    To clarify this is deleting a recreating the mail profile on the IOS 6.1 device? Has the issue returned for anyone after doing this?

    We have tracked it down to being a calendar invitation accepted on the IOS 6.1 device and this causing repeated deletions into the dumpster and therefore rapidly increasing exchange logs.

    Wednesday, February 06, 2013 2:25 PM
  • bryanfrgrg 

    We experiencing the same issue and as you mentioned is related to users accepting Calendar invites on the iPhones.  For a particular users we exported the calendar, deleted it and recreated it and re-imported it and it worked but to me this is not I want to do for every iphone user.  We will try recreating the partnership and report back.

    Wednesday, February 06, 2013 4:07 PM
  • We are expirincing issues with 6.1 as well we had our exchange server logs fill up and traced it back to an Iphone 6.1 calendar sync.  Does anyone have any updates on this.

    MCSE 2003 Messaging and Softgrid guy

    Thursday, February 07, 2013 10:34 PM
  • https://devcentral.f5.com/community/group/aft/2165837/asg/50

    This is more informative, the last few hours we started experenceing issues with Apple iOS 6.1, essentially malformed meetings on a device cause the device to get into a sync loop which causes excessive transaction log growth on the Exchange mailbox servers which will cause Exchange performance issues and potentially transaction log drives to run out of disk space which would then bring down Exchange.

    Exchange has a limited ability in blocking options, to work around this we added the following iRule to our present Exchange ActiveSync iRule.

    We just disabled all IOS 6.1  on our exchange system


    MCSE 2003 Messaging and Softgrid guy

    Thursday, February 07, 2013 11:12 PM
  • I would also ask the meeting organizer to cancel the meeting request as this seems to stop the repeated requests.

    Twitter!:

    Friday, February 08, 2013 3:46 PM
  • yes this is a known issue of late - 

    http://exchangeserverinfo.net/2013/02/exchange-2010-high-transaction-log-growth/


    Dominic Savio | MVP – Exchange Server (2008 ) | MCITP| MCSA: M | www.ExchangeServerInfo.Net

    Monday, February 11, 2013 11:51 AM
  • Hi Bobby,

    Witch Exchange Version? Update Rollup Package?

    We are using Exchange 2010 with the current Update Rollup - don't see this massive Log on our Databases..

    Regards Andres


    MCSE 2003 / MCSA 2003 Messaging / MCTS: Windows Server 2008 / MCTS: Windows Vista, SQL 2005 / MCTS: Microsoft System Center Operations Manager 2007 / MCITP: Enterprise Administrator / MCITP: Enterprise Messaging Administrator 2007 / 2010 / VCP - VMWare Certified Professional

    • Proposed as answer by Marvin Daie Monday, February 11, 2013 9:12 PM
    • Unproposed as answer by Marvin Daie Monday, February 11, 2013 9:12 PM
    Monday, February 11, 2013 12:13 PM
  • Hi,

    Could you specify which event ID this many recurrent access from iDevice under iOS 6.1 to Exchange Servers generates ? Is it Event ID 3005 ?

    Br



    • Edited by Marvin Daie Monday, February 11, 2013 10:00 PM
    Monday, February 11, 2013 9:16 PM
  • Please read the KB that Andy posted above.  I'll paste it here so the URL is visible

    http://support.microsoft.com/kb/2814847

    There are some workarounds listed in the KB, and the Exchange community is also active on this issue on Twitter so you may want to keep an eye on the #MSExchange and #Exchange 2010 Twitter feeds.  Please carefully review all content that you may see on Twitter/Internet and test in a lab prior to making production changes.


    Cheers,

    Rhoderick

    Microsoft Senior Exchange PFE

    Blog: http://blogs.technet.com/rmilne  Twitter:   LinkedIn:   Facebook:   XING:

    Note: Posts are provided “AS IS” without warranty of any kind, either expressed or implied, including but not limited to the implied warranties of merchantability and/or fitness for a particular purpose.

    • Marked as answer by BPendino Thursday, February 14, 2013 2:24 PM
    Tuesday, February 12, 2013 1:47 PM
  • Thanks for the information.

    I assume this does NOT apply to Exchange 2007.   (The KB says e2010).

    Can anyone verify that ?

    Also, my iPhone now says version 6.1.1

    I wonder if the iPads will also go from 6.1 to 6.1.1 ?

    (Sorry if these are "entry-level" iOS questions...still learning.)

    Thanks

    ===

    Tuesday, February 12, 2013 5:55 PM
  • Apple releases support article:

    http://support.apple.com/kb/TS4532

    iOS 6.1: Excess Exchange activity after accepting an exception to recurring calendar event


    Twitter!:

    Wednesday, February 13, 2013 3:12 AM
  • Enable Circular Logging as temporal workaround! ;-)
    Wednesday, February 13, 2013 9:02 AM
  • Yeah, I'd found the same things everyone else has.  Sorry I hadn't checked this thread for a while.  I'd figured it was common knowledge after a while.

    The first day I found this I started disabling activesync for all offending iOS 6.1 users and would force them to reset their exchange profile on their devices.

    We also informed our users not to create, delete, accept, or modify any calendar items on their iOS devices.

    We still have violators so we block them, but other than that... Still not liking Apple right now.

    iOS 5.x - Similar issues with synchonization

    iOS 6.0 - Calendar Meeting Hijacking

    iOS 6.1 - Calendar issue/Exchange logging out of control.


    Bobby Pendino

    Thursday, February 14, 2013 2:18 PM
  • Thanks for the information.

    I assume this does NOT apply to Exchange 2007.   (The KB says e2010).

    Can anyone verify that ?

    Also, my iPhone now says version 6.1.1

    I wonder if the iPads will also go from 6.1 to 6.1.1 ?

    (Sorry if these are "entry-level" iOS questions...still learning.)

    Thanks

    ===

    iOS 6.1.1 is only for iphone 4S.  It was mainly to fix some mapping problems from what I read, but there were other fixes there.  6.1.1 does NOT fix this issue. 

    Apple just barely admitted there was a problem.


    Bobby Pendino

    Thursday, February 14, 2013 2:20 PM
  • Please read the KB that Andy posted above.  I'll paste it here so the URL is visible

    http://support.microsoft.com/kb/2814847

    There are some workarounds listed in the KB, and the Exchange community is also active on this issue on Twitter so you may want to keep an eye on the #MSExchange and #Exchange 2010 Twitter feeds.  Please carefully review all content that you may see on Twitter/Internet and test in a lab prior to making production changes.


    Cheers,

    Rhoderick

    Microsoft Senior Exchange PFE

    Blog: http://blogs.technet.com/rmilne  Twitter:   LinkedIn:   Facebook:   XING:

    Note: Posts are provided “AS IS” without warranty of any kind, either expressed or implied, including but not limited to the implied warranties of merchantability and/or fitness for a particular purpose.

    Right, this is exactly what I'd already been doing since I guess 1 or two days after identifying the problem.

    At the time I was aware the problem originated with iOS 6.1 and the calendar, but did not know exactly was causing the issues.

    Good thing is the workarounds at least keep exchange from crashing.

    Thanks!


    Bobby Pendino

    Thursday, February 14, 2013 2:24 PM
  • Hi Everyone,

    Just to acknowledge, I run an exchange 2007 Environment, and we have about 1500-2000 ipad's and iphones connected to our environment, and we've seen this occur in the past few weeks.

    Thank Goodness for SCOM alerts - The TLOG data write threshold was hit and was paged out, and after monitoring, isolated the problem, I disabled the users Active Sync profile for ~10 minutes, and re-enabled it, and this calmed things down.

    I realize and appreciate all the information that is being posted regarding this event.

    Unfotunately being on 2007, we can't adopt some of the more elegant solutions, but the past few months we have encountered a few apple issues!

    - the Calendar Hijack issue

    - now this!

    ..Stop the insanity! ;-)

    Saturday, February 16, 2013 5:24 AM