Exchange 2003 I/O Troubles

Question

We have some internal processes that send email to our Exchange 2003 system (on Win2K3 R2 32bit). Recently they have been intermittently failing with various errors -- boiled down they report "Exchange refused the connection". We use XWall as our spam filter (and XWall Filter for Outlook client integration) and it is also reporting "Connection closed for no reason" which could indicate that the Exchange server is having problems keeping up.

We only have about 25 user mailboxes (about 20-25GB total) and the CPU load on the machine is not pegged (it's a 8-core Dell w/4GB RAM). My guess is that it's I/O bound in some way. We get a metric ton of spams and my guess is the box can't keep up. How would I go about diagnosing this (user mailboxes are not reporting anything amiss)? What should I look at to see where the bottleneck is -- disk I/O? Network I/O? CPU? etc.? How do I tweak Exchange?

Yeah, I can look at Task Manager, but that's not really telling me anything. Thanks!!

Answer 1

Perfmon is your friend. Chart gross performance of CPU (% utilization, % user mode vs kernel mode, context switches), disk (queue length, % disk time), and memory (page faults / sec, working set sizes) for starts. That'll give you a place to start looking. If you're most interested in IO, you might grab the "Process" counters for the Exchange services associated with IO (IO Read / Write Bytes or Operations per second) and get those on the chart, too.

Without knowing more details, it's difficult to tell you what counters on Exchange services to look at. I haven't seen a lot of situations where the Exchange/Windows SMTP service doesn't answer for connections. It surprises me, actually, to hear that it's not answering for SMTP. I wonder if you might have a network problem in the mix here, too. You might consdier sniffing traffic between the XWall machine and Exchange (if you can catch it in the act) and see if it's really a matter of unanswered SMTP sessions.

Answer 2

You could enable diagnostic logging and see what's happening in more or less real time. Also you could look into trying to block domains or IP ranges from which the spam is originating if you haven't already.

Answer 3

Does this server have any other function than Exchange(that's a lot of CPU)?

Do you use OWA? Do you have the /3GB boot switch enabled? (These don't always play well together).

What client do users use to connect with and if Outlook do they use "Exchange Proxy"?

What's the storage look like (local/SAN, SATA/SAS, RAID level). You should see too much trouble with just 25 users.

There are lots of angles to an exchange environment to look at.....

Answer 4

The first thing I would do is to use process explorer to determine where the bottleneck is, is it disk or RAM etc. Once you know that you can look at resolving what's causing it. The easiest option is obviously to throw hardware at it, will more RAM or faster disks help, or moving Exchange to its own disk. If this is being caused by spam, you could also look at putting in a front end server to handle spam before it gets to Exchange, something like postfix.

As for configuration fixes, you could look at getting XWall to drop as much spam as possible before it even reaches the Exchange server, which will help reduce the load on Exchange.