2

One of our clients is running a windows SBS server 2011, with users in both a TS environment and local lan computer access. This is a small environment with approximately 35 users.

The symptoms we are experiencing are as such:

individual users will experience outlook not responding for approximately 5-10 minutes at a time, at roughly the same time every day, as well as random times. This happens to both TS and local users. There isn't usually overlap between users, ie, different users will experience the issue at different times, whilst others continue to work without incident.

What we have observed:

  • Store.exe on the Server running exchange has constantly high disk access. varying between 5-10MB/s read access, with between 1-5MB/s write access (according to resource monitor). This remains constant regardless of people experiencing lockout. This activity dissapears at night time when no one is accessing the system.

  • During the users lockout of outlook, Exmon will report very high avg server latency for the specific user in question, (60 seconds latency is average during this time, normally sitting between 0 and 500 msec). Other unaffected users do not have high latency

  • during lockout, the users in question will have a high session count

Additional notes:

  • Event log doesn't appear to report anything related
  • There is nothing scheduled on the exchange server during the times people experience the lockout
  • all windows updates and service packs have been applied to both servers and to office.
  • when locked out, you cannot even open the mail control panel item for the exchange settings page for the specific user

Server Spec:

  • dual cpu xeon e5606@2.13
  • 24GB Memory
  • SAS 15K (seagate Cheetah) - 300gb pair in raid 1

We are at a loss as to what is causing the issue at this stage.

Any suggestions or direction would be greatly appreciated.

HopelessN00b
  • 53,385
  • 32
  • 133
  • 208
KCS
  • 31
  • 5
  • Your units are wrong and it makes a difference. Is it Mb or MB? mb isn't a unit of measure that is used in our field. What is the hardware config of the exchange server? Specifically disk layout and rotational speed? – MDMarra Jan 30 '14 at 04:11
  • Apologies, fixed that up and added specs (it's MB/s) – KCS Jan 30 '14 at 04:30

2 Answers2

2
  1. It's not TCP connection exhaustion.
  2. Use Perfmon to log and check your key server metrics. I'd start with disk, as I'm fairly confident the issue is that you have a very long disk queue length.
  3. Check your hardware, both to make sure it hasn't gone bad and so you can get an idea of what performance you should be capable of.
    • The last time I saw this happen (5-10 minute, sporadic freezes for certain users), the issue was bad blocks on one of the server's disks.
    • The time before last that I saw this it was massive disk queue due to users opening >10 GB .pst files over a network share.
    • Having a disk configuration that does not support the level of IOPS your users are throwing at the server can also cause this type of behavior in use-cases similar to yours.
HopelessN00b
  • 53,385
  • 32
  • 133
  • 208
1

Looks like the issue was caused by their antivirus.

There is a configuration in the MSExchangeIS service that enables background virus scanning.
With this enabled the antivirus was re-scanning the entire 120gb mail database 3 times a day.
Every time the virus definitions were updated it would trigger a new scan.
In doing so it was locking mailboxes as it scanned through.

If anyone else has an issue like this, check the following registry key
HKLM\system\currentcontrolset\services\MSExchangeIS\VirusScan\BackgroundScanning
set this to 0

KCS
  • 31
  • 5