We have been having issues with exchange 2003 performance issues over the past few weeks. With perfmon we can tell that the issue is related to disk i/o( we have high Avg Disk sec/Read and Disk Queue length and RPC avg latency), but it is intermittent. I have been able to narrow it do to occuring when .ifs files exist and are increasing in size. When there are no .ifs files everythings returns to normal. These files are small, max of around 2-3mb so its not the actual writing of the files causing the problems, its whatever process creates them or overhead of calculating whatever information is put in the file. I have looked up about these files on KB260532 which says they are normal and will come and go. I cant find any other information such as why these files are created, what they contain, when/why they are deleted. I ran process monitor and during around only 1-2 minutes we had ~500k disk events and the bulk of them where to do with one of the ifs files. How can a file so small cause so much disk I/O?

You dont need to worry about those .IFS files they are the temporary files created by information store. Take a look at http://support.microsoft.com/kb/260532 Also, can you confirm that you have the file level antivirus exclusions set correctly?Milind Naphade | MCTS:M (Exchange 2007 and 2010) | http://www.msexchangegeek.com

Hi thanks for the response, but did you read my entire post? I already mentioned i looked at kb 260532 and yes i understand it, but has to be related that i only see the disk i/o issue when those files exist. I can sit and watch performance monitor and the instant one of those files appear all the i/o stats go nuts. I turned on process monitor and ~500k of i/o events over the period of only 1-2 minutes and most of them where one of the .ifs files. We do use symantec endpoint protection and we tried totally disabling it and that didnt make a difference.

The fact that those files are there means that Exchange is doing something. You are looking at the symptoms, not the cause. The fact that those files are there isn't the cause of your performance problems, that is elsewhere. You haven't said anything about the storage configuration of the server, but storage is the key bottleneck with Exchange performance. If you have the transaction logs and the databases on the same array/disk for example, then Exchange will be very slow, because it is writing to the same drives in two different places at almost the same time. The Exchange performance troubleshooting tool, which is a free download from Microsoft will identify if that is the cause or not. Simon.Simon Butler, Exchange MVP. http://blog.sembee.co.uk , http://exbpa.com/

I put togther some resources on just general Exchange 2003 troubleshooting. http://almostdailytech.com/2009/05/24/troubleshooting-exchange-2003-performance-issues/Mark Morowczynski|MCT| MCSE 2003:Messaging, Security|MCITP:EMA 2K7,EDA Win 7,ES,SA,EA|MCTS:Windows Mobile Admin|Security+|http://almostdailytech.com

Thanks again for the responses. The server being the underlying issue has crossed our minds, but this server has been fine for the past 2 months and this issue stared 2 weeks ago. I am not the server guy so i am not totally sure on the details, i am just trying to find different suggestions. I will suggest this gets looked into further though. What i can seem to find out is what "something" exchange is doing to make those files. It can go 1 hour or 5 minutes with there being no files and performance being fine, with no obvious changes in user activity. We have up to 200 concurrent users and i even had one try a large search and that didnt make the ifs files show up during a period of "normal" behavior. Thanks for the link Mark i will look those over.

My thinking is that since the appearance and disappearance of the IFS files is normal, your users have finally tipped your disk subsystem over. How much memory is in this system and what is your disk subsystem configuration for the database and log files? -- Ed Crowley MVP "There are seldom good technological solutions to behavioral problems." . "cooldude919" wrote in message news:70351e04-bf74-40bb-b94c-23adef712b57... Thanks again for the responses. The server being the underlying issue has crossed our minds, but this server has been fine for the past 2 months and this issue stared 2 weeks ago. I am not the server guy so i am not totally sure on the details, i am just trying to find different suggestions. I will suggest this gets looked into further though. What i can seem to find out is what "something" exchange is doing to make those files. It can go 1 hour or 5 minutes with there being no files and performance being fine, with no obvious changes in user activity. We have up to 200 concurrent users and i even had one try a large search and that didnt make the ifs files show up during a period of "normal" behavior. Thanks for the link Mark i will look those over. Ed Crowley MVP "There are seldom good technological solutions to behavioral problems."

Server is a dell r610. Dual quad core e5540 2.53ghz with 8gb of ram. Drive array is internal 6x146gb sas 15k in raid 5 array. I know the database is split into 3 stores, not sure about the log files.

Server is a dell r610. Dual quad core e5540 2.53ghz with 8gb of ram. Drive array is internal 6x146gb sas 15k in raid 5 array. I know the database is split into 3 stores, not sure about the log files. Oh dear. That is a very poor configuration for Exchange. RAID 5 is the slowest RAID performance of the lot and you have everything on the same array. Splitting stores up etc will nothing to aid the performance of the server. With six disks you should have three mirrors, one for the OS, one for the logs and one for the database. If you need more space then the logs and OS can go on the same array (Although I usually put them in to seperate partitions). Your server was crippled from the start. Simple as that. Processor/RAM - they will be unable to compensate for the storage configuration. The only way that you will get more performance out of that server is by moving everything to another machine, reconfiguring the arrays and then moving everything back. Simon.Simon Butler, Exchange MVP. http://blog.sembee.co.uk , http://exbpa.com/

Okay, the 8GB of RAM could be a problem. Exchange can't use more than 4GB, so you might want to consider removing half of it. See this article for tuning memory for Exchange 2003: http://support.microsoft.com/kb/815372 If you have the transaction logs on the same RAID-5 volume as the transaction logs, OS and page file, that could certainly explain why you're seeing sluggishness. If you haven't done so already, you should run Performance Monitor with disk counters to drill down on whether that is indeed the case. It is strongly recommended to separate the transaction logs from the databases not only for performance, but for recoverability in the event of a single physical disk volume failure. -- Ed Crowley MVP "There are seldom good technological solutions to behavioral problems." . "cooldude919" wrote in message news:0449ed0a-4c8a-4d9f-95aa-8e15d7258cc5... Server is a dell r610. Dual quad core e5540 2.53ghz with 8gb of ram. Drive array is internal 6x146gb sas 15k in raid 5 array. I know the database is split into 3 stores, not sure about the log files.Ed Crowley MVP "There are seldom good technological solutions to behavioral problems."

Or upgrade to Exchange 2010. (Which you can't do in place, but it would use that disk array far more efficiently, especially if more RAM were added.) -- Ed Crowley MVP "There are seldom good technological solutions to behavioral problems." . "Sembee" wrote in message news:f3bac554-0190-4c91-a43b-3cc31613cd2f... Server is a dell r610. Dual quad core e5540 2.53ghz with 8gb of ram. Drive array is internal 6x146gb sas 15k in raid 5 array. I know the database is split into 3 stores, not sure about the log files. Oh dear. That is a very poor configuration for Exchange. RAID 5 is the slowest RAID performance of the lot and you have everything on the same array. Splitting stores up etc will nothing to aid the performance of the server. With six disks you should have three mirrors, one for the OS, one for the logs and one for the database. If you need more space then the logs and OS can go on the same array (Although I usually put them in to seperate partitions). Your server was crippled from the start. Simple as that. Processor/RAM - they will be unable to compensate for the storage configuration. The only way that you will get more performance out of that server is by moving everything to another machine, reconfiguring the arrays and then moving everything back. Simon. Simon Butler, Exchange MVP. http://blog.sembee.co.uk , http://exbpa.com/Ed Crowley MVP "There are seldom good technological solutions to behavioral problems."