Exchange Server Forums

Exchange generating large emails

Users viewing this topic: none

Logged in as: Guest

Printable Version

All Forums >> [Microsoft Exchange 2003] >> General >> Exchange generating large emails

Page: [1]

Message

<< Older Topic Newer Topic >>

Limited time MSExchange.org offer! -- 1.Sep.2008 1:00:00 PM

TechGenix and SolarWinds have partnered to provide free copies of SolarWinds Exchange Monitor to all visitors who join the MSExchange.org Forums. SolarWinds Exchange Monitor is a handy desktop dashboard that continuously monitors Microsoft Exchange to deliver real-time insight into Exchange services, mail queue sizes, and host server health. Learn more about Exchange Monitor and the free offer!

Exchange generating large emails - 22.Sep.2008 4:32:22 AM

Green162542

Posts: 10
Joined: 22.Sep.2008
Status: offline

I'm desperate to find a solution to this problem and I wonder if anyone could help?

Some of our users have reported large emails coming into their inboxes. The emails are usually from legitimate sources but the size of the email can be between 6-9mb. I have had one user report a 497mb email and due to the size, this message cannot be deleted!

There are no attachments on the email. Once the email is open it looks like part of the message boy is being repeated over and over and over again.

I use a little POP3 connector to retrieve our mail from our ISP and this then forwards the mail onto our Exchange server. Checking the logs on the connector shows the messages to be only around 6kb for these problem messages. I believe something is happening to the messages on the server however I've no idea what would cause the messages to blow up to these extraordinary sizes.

I'm running Exchange 2003 on Server 2003. All the latest service packs and hotfixes are installed and I've recently installed F-Secure for Exchange to see if there is a virus that could be causing this. Everything has come up clean.

Because of these emails, our backup is now growing to a very large size. I need to find out what is causing this and fast. Can anyone help???

Post #: 1

Featured Links*

RE: Exchange generating large emails - 22.Sep.2008 7:16:04 AM

jveldh

Posts: 638
Joined: 12.Apr.2008
From: The Netherlands
Status: online

Hi,

Have you tried to disable the AV to check if this is causing the issue ?

_____________________________

Best regards,

Johan Veldhuis

Visit my website

(in reply to Green162542)

Post #: 2

RE: Exchange generating large emails - 22.Sep.2008 7:27:29 AM

Green162542

Posts: 10
Joined: 22.Sep.2008
Status: offline

This problem was occuring before the AV software was installed.

(in reply to jveldh)

Post #: 3

RE: Exchange generating large emails - 22.Sep.2008 1:12:59 PM

jveldh

Posts: 638
Joined: 12.Apr.2008
From: The Netherlands
Status: online

Hi,

And is there running any other 3rd party software on the server ?

_____________________________

Best regards,

Johan Veldhuis

Visit my website

(in reply to Green162542)

Post #: 4

RE: Exchange generating large emails - 22.Sep.2008 1:19:20 PM

Green162542

Posts: 10
Joined: 22.Sep.2008
Status: offline

No other software is installed on the machine - just Exchange 2003 and now the AV software

(in reply to jveldh)

Post #: 5

RE: Exchange generating large emails - 22.Sep.2008 2:16:06 PM

uemurad

Posts: 5469
Joined: 7.Jan.2004
From: California, USA
Status: offline

First, confirm that the Exchange System Manager sees whether the recipient's mailboxes reflect the addition of the huge message.

Second, if the user can see the message in the Inbox, have him/her try to Shift-Delete the message (so that it bypasses the attempt to move it to the Deleted Items folder).

Are you running Exchange Standard or Exchange Enterprise?
Look in your Application Log on your Exchange mailbox server for the latest 1221 Event. How much whitespace is reported?

_____________________________

Regards,

Dean T. Uemura
Microsoft MVP - Exchange
exchangeguy.blogspot.com
uemurad@yahoo.com

(in reply to Green162542)

Post #: 6

RE: Exchange generating large emails - 22.Sep.2008 4:13:29 PM

Green162542

Posts: 10
Joined: 22.Sep.2008
Status: offline

We're running Exchange 2003 standard on Win2003 standard.

I've checked the application log for 1221 - Public store has 3mb free and the private store, 74mb.

I will give the shift-delete a try tomorrow when that user is back in the office and will let you know what happens - as far as I can tell, the exchange system manager is including the huge email but I will verify this.Thank you for your assistance.

I will let you know the outcome tomorrow.

(in reply to uemurad)

Post #: 7

RE: Exchange generating large emails - 23.Sep.2008 5:15:18 AM

Green162542

Posts: 10
Joined: 22.Sep.2008
Status: offline

Well we've had some more messages overnight that are around 7mb with the same symptoms. Exchange System Manager appears to be reflecting the correct sizes.

The absolutely huge email has been deleted by the user. They tried to do it offline and this seemed to work when it sync'ed back to the server.

The large emails are still a problem though.

(in reply to Green162542)

Post #: 8

RE: Exchange generating large emails - 23.Sep.2008 10:22:32 AM

uemurad

Posts: 5469
Joined: 7.Jan.2004
From: California, USA
Status: offline

Glad to hear that you've gotten rid of that gigantic message. Watch the 1221 events to make sure it's been converted to whitespace.

Understand that Exchange never shrinks the physical size of the database files while the Mailbox Store is online. In other words, unless you manually take steps, the EDB and STM files will never get smaller, regardless of how much whitespace they contain.

You need to decide if and when it is necessary to shrink the databases. You haven't mentioned how big they are, so I can't assess your situation fully. Shrinking them involves taking the store offline (mail unavailable) and risks introducing corruption (albeit a small risk).

You said your backup is growing as a result. Are you backing up the Information Store, or are you performing "brick" backups?

When you mention that ESM is reflecting the correct sizes, does that mean it sees the 7MB messages as 7MB, or as something smaller?

Is there any commonality to the "corrupted" messages? Do they come from the same place? Are they even legitimate messages? Do they take a different path to your environment than the messages that don't show the same problem? I'd compare the message headers of the two different types to check.

_____________________________

Regards,

Dean T. Uemura
Microsoft MVP - Exchange
exchangeguy.blogspot.com
uemurad@yahoo.com

(in reply to Green162542)

Post #: 9

RE: Exchange generating large emails - 24.Sep.2008 4:00:00 AM

Green162542

Posts: 10
Joined: 22.Sep.2008
Status: offline

I performed an offline defragmentation over the weekend after initially discovering this problem (I was hoping that this would get rid of the huge email which has now been removed by other means)

I use the ntbackup program to backup the Information store - while I expect the backup to grow slightly (as would be the case after a day of recieving email) on the day we recived the huge 497mb email, the backup file jumped up by almost 700mb wich is a huge leap compared to normal.

When we open these 7mb emails, the message body starts to loop round and round and round part way down the message with the same part of the message body. I've not seen a pattern in the domains these are coming from but they are coming from legitimate business contacts.

All emails are downloaded from our ISP using a POP3 connector. Once downloaded, these are then forwarded onto the SMTP service of the exchange server. What is unusual is that according to the logs of the POP3 connector, the emails are of a normal size.

Its a shame I can't upload an example of the bad email somewhere for you guys to have a look. The messages are really bizzare.

(in reply to uemurad)

Post #: 10

RE: Exchange generating large emails - 24.Sep.2008 1:18:00 PM

jveldh

Posts: 638
Joined: 12.Apr.2008
From: The Netherlands
Status: online

Hi,

Can you post the internet header maybe something strange is in it.

_____________________________

Best regards,

Johan Veldhuis

Visit my website

(in reply to Green162542)

Post #: 11

RE: Exchange generating large emails - 25.Sep.2008 10:20:46 AM

Green162542

Posts: 10
Joined: 22.Sep.2008
Status: offline

Well I've made some progress with this. I've been monitoring everything closely throughout the day and keeping an eye out for any large emails. I realised that one log I'd not been checking was the SMTP virtual server so I added that to the list of diagnostics to check.

About an hor ago an email was downloaded to the POP3 connector which was 17kb (17317 bytes to be presise). Once this email had got to the mailbox, Outlook reported the email to be 3mb.

I checked the SMTP log of the virtual server for the associated transaction. I checked under the cs-method DATA entry for that message and it was reported to be 3580829 (which equates to just over 3mb)

So it leads me to the conclusion that either the POP3 connector is sporadically changing messages after they have been downloaded before forwarding on to the server. Either that or the SMTP service is going crazy during the transport of some messages which leads them to being altered before getting to the mailbox of the user.

I will keep investigating. Incidentally here are the internet headers of one of the bad emails

Microsoft Mail Internet Headers Version 2.0
Received: from mars ([191.100.1.8]) by POSTOFFICE01.primedoc.co.uk with Microsoft SMTPSVC(6.0.3790.3959);
Thu, 25 Sep 2008 14:03:50 +0100
Return-Path: <[email=js-bounces@subscriptions.jobsite.co.uk]js-bounces@subscriptions.jobsite.co.uk[/email]>
Delivered-To: [email=pop-primedoccouk-greerp@primedoc.co.uk]pop-primedoccouk-greerp@primedoc.co.uk[/email]
Received: (qmail 10469 invoked from network); 25 Sep 2008 13:00:35 -0000
Received: from unknown (HELO smtp-in-9.star.net.uk) (10.200.12.9)
by welly-4.star.net.uk with SMTP; 25 Sep 2008 13:00:35 -0000
Received: (qmail 30414 invoked from network); 25 Sep 2008 13:00:34 -0000
Received: from unknown (HELO mail186.messagelabs.com) (85.158.138.131)
by smtp-in-9.star.net.uk with SMTP; 25 Sep 2008 13:00:34 -0000
X-VirusChecked: Checked
X-Env-Sender: [email=js-bounces@subscriptions.jobsite.co.uk]js-bounces@subscriptions.jobsite.co.uk[/email]
X-Msg-Ref: server-7.tower-186.messagelabs.com!1222347633!15359803!1
X-StarScan-Version: 5.5.12.14.2; banners=-,-,-
X-Originating-IP: [194.193.238.21]
X-SpamReason: No, hits=0.1 required=7.0 tests=ratty_date: Non-RFC but
legit format in Thu, 25 Sep 2008 11:31:36 UT\n,HTML_MESSAGE
Received: (qmail 27835 invoked from network); 25 Sep 2008 13:00:33 -0000
Received: from sys21.jobsite.co.uk (HELO chopin.jobsite.co.uk) (194.193.238.21)
by server-7.tower-186.messagelabs.com with SMTP; 25 Sep 2008 13:00:33 -0000
Received: (qmail 18662 invoked by uid 513); 25 Sep 2008 11:31:36 -0000
Message-ID: <20080925113136.18656.qmail@chopin.jobsite.co.uk>
Content-Transfer-Encoding: binary
Content-Type: multipart/alternative; charset=iso-8859-1; boundary="_----------=_1222342296537413019"
MIME-Version: 1.0
X-Mailer: MIME::Lite 3.01 (F2.73; A1.74; B3.07; Q3.07)
Date: Thu, 25 Sep 2008 11:31:36 UT
Subject: Infrastructure Specialist - Leeds - 38k to 42k pa + excellen
X-Jbe-Id: 32506821
X-Forwarder: Redirected by EFS, http://www.chimeracomputing.com/
To: greerp@primedoc.co.uk
From: Jobsite Jobs-by-Email Alert <[email=jbe-vac@jobsite.co.uk]jbe-vac@jobsite.co.uk[/email]>
X-OriginalArrivalTime: 25 Sep 2008 13:03:50.0281 (UTC) FILETIME=[27671F90:01C91F0F]
X-CT-RefID: str=0001.0A0B0203.48DB8C48.0091:SCFEO25485,ss=1,fgs=0
--_----------=_1222342296537413019
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable
Content-Type: text/plain; charset=iso-8859-1
--_----------=_1222342296537413019
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable
Content-Type: text/html; charset=iso-8859-1

--_----------=_1222342296537413019--

Any ideas?

(in reply to jveldh)

Post #: 12

RE: Exchange generating large emails - 25.Sep.2008 12:34:18 PM

jveldh

Posts: 638
Joined: 12.Apr.2008
From: The Netherlands
Status: online

Hi,

Try to disable the forwarding to Exchange and let them stay in the queue of the pop3 program. Then check if the mails get bigger when downloaded.

_____________________________

Best regards,

Johan Veldhuis

Visit my website

(in reply to Green162542)

Post #: 13

RE: Exchange generating large emails - 26.Sep.2008 10:03:57 AM

Green162542

Posts: 10
Joined: 22.Sep.2008
Status: offline

I've given that a whirl and I've managed to catch one of the bad emails. An email was downloaded as being 124kb. I took a copy of this before it was transfered. to the SMTP service on the Exchange server.

I kicked off the smtp transter and it seemd to take a long time for a 124kb file. According to the SMTP log, the mail was about 9mb!.

As I'd taken a copy of the message, I placed another copy in the transfer queue. This time it took even longer to transfer and the smtp log reported the email to be 22mb. On a thrid attempt it took longer still and this time it was nearer 90mb!

It looks like something is going on during the SMTP transfer but what exactly, I do not know.

(in reply to jveldh)

Post #: 14

RE: Exchange generating large emails - 26.Sep.2008 2:13:15 PM

jveldh

Posts: 638
Joined: 12.Apr.2008
From: The Netherlands
Status: online

Hi,

This is very strange I must admit that I don't have seen this ever before. Maybe somebody else has seen this issue ?

_____________________________

Best regards,

Johan Veldhuis

Visit my website

(in reply to Green162542)

Post #: 15

RE: Exchange generating large emails - 29.Sep.2008 4:50:10 AM

Green162542

Posts: 10
Joined: 22.Sep.2008
Status: offline

It is certainly a mystery - I will keep you posted.

(in reply to jveldh)

Post #: 16

RE: Exchange generating large emails - 29.Sep.2008 9:20:36 AM

Exchange_Geek

Posts: 1006
Joined: 31.Dec.2006
Status: online

Such issues are mostly caused by corrupt SMTP Temp Tables - POP3 doesnt seem to be corrupt.

Ref: http://blogs.technet.com/11/archive/2008/03/18/using-mfcmapi-to-delete-exchange-2003-temp-tables.aspx

Before you perform the above steps - stop SMTP Services and take a back up of the MailRoot folder - this should be located under Exchange Installation Drive\Program Files\Exchsrvr. For example by default you would find that under C:\Program Files\Exchsrvr.

Update us with your troubleshooting - all the best.

(in reply to Green162542)

Post #: 17

RE: Exchange generating large emails - 2.Oct.2008 5:19:13 AM

Green162542

Posts: 10
Joined: 22.Sep.2008
Status: offline

I gave that a try but it didn't seem to work. I've moved the POP3 connector onto the Exchange server itself to see if that will help - will keep you posted

(in reply to Exchange_Geek)

Post #: 18

RE: Exchange generating large emails - 3.Oct.2008 3:02:01 PM