Hi! I'm experiencing this weird problem on one of my customers Win2K3 Std. R2 SP2 server with Exchange 2003 SP2 installed (fully updated). Every 14th day the night between friday and saturday the information store stops responding. No errors or warnings are logged in the event log so I'm not totally sure exactly when it happens. The first indication that something is wrong is an ActiveSync warning in the Application log (event id 3007) stating that "Exchange mailbox Server response timeout.......". This error comes because a mobile phone tries to syncronize with the server. Can anyone point me in a direction here? What happens every 14th day on an Exhange 2003 server? What monitoring/logging steps should i take to troubleshoot this? All help will be much appreciacted and many thanks in advance for reading this Best Regards Thomas Denmark

Hi, Please give us more information like, Where is the GC located on the same box or on another box? Do we have a FE-BE scenario or a single exchange box? Which antivirus are you using? From when are you facing this problem? Were there any recent changes in the environment? Also let me know if there are any other events IDs Which exchange server are you using? Standard Edition/Enterprise edition? What is the size of your database? Check if Information Store Service stops working or the System Attendant? You can download and run the ExBPA v2.8 tool(www.exbpa.com) and check if there are any relevant listing under critical / all issues Go to Start>All Programs>Support Tools> Command Prompt. Type the following command: Dcdiag /v > C:\dcdiag.txt and Netdiag /v > C:\Netdiag.txt Open these text files, and search for fail, let me know where it failed. Perform this steps when you face the issue (i.e. on the 14th day)

Hi Harpreet! Thank you very much for your answer and sorry for the late reply but I've been busy with other customers. First of all I can confirm that the server itself is a GC server. This is not a FE-BE scenario, the Exchange scenario istwo "normal" Exchange servers located at seperate geographical locations connected by use of a VPN connection. Eachlocation has it's own GC domain controller. Next the server is currently only runningan Exchange messaging antivirusagent (no file scanner of any sorts). TheExchangeantivirusagent is "Trend Micro Messaging Security Agent" managed from the "Trend Micro Worry-Free Business Security -Advanced" package version 5.0. Scan engine 8.700.1004. Sadly I haven'tgot the exact date of when the problem first occurred. My guessis though that we first saw the problem late august/early september this year. No other event ID warnings/errors are displayed when the issue happens. Exchange server is 2003 Standard Edition SP2 with all updates installed from Microsoft Update. The database size is 17.9GB which actually trickers something in me. I can see in the registration database that I've made entries for the mailbox store to allow it to grow to 36GB but I actually noticed that the value which I believe should be called "Database Size Limit in Gb" is actually called "Database Size Limit in GB" with a capital "B" in "GB". I've corrected the value and I will restart the IS before this weekend. Also I've created the value "Database Size Check Start Time in Hours From Midnight" and set it to 2:00AM. Perhaps I can see that the IS crashes earlier now. The EXBPA told me that the value "HeapDeCommitFreeBlockThreshold" was not set so I've set it to the recommended value. I've run the two diags you mentioned and they don't produce any errors. I will run 'em again if the problem occurs and check them for failed queries. Many thanks for your help so far, I will get back to you asap Best Regards Thomas Denmark

Please also check if the following registry key is present or not: HKLM\System\CurrentControlSet\Services\MSExchangeIS\VirusScan Under VirusScan, there would be many values, but we need to check for the following values 1. Proactive Scanning (Value should be 1)2. Background Scanning (Value should be 1)3. Enabled (Value should be 1) After making any changes to MSExchangeIS, we need to restart the Information store. If the above key "VirusScan", is not present then exclude the following directories C:\Program Files\EXCHSRVR C:\InetPub C:\Windows\System32\InetSRV

Hi Harpreet! Thank you for the quick answer and again sorry for a late reply. First off the server ran smoothly through the weekend so it seems that either the problem has been fixed or just delayed because of the server restart Iperformed In reply to your questions the reg. vaules are present and set as you describe except for Backround Scanning that has a value of 0.I haven't changed it yet, but will try it if the server gives me trouble again (which AV does it affect, file scanner or message scanner?). In regards to your proposed exclusions I don't think they are relevant at this moment since no file scanner is installed. Only a messaging scanner is installed and running but I will take note of 'em and exclude 'em if O decide on installing a file scanner at some point. Thanks again, I will get back to youas soon as possible either with themessage that everything works fine now, or with more questions Best Regards Thomas

Hi Harpreet! Sadly the problem wasn't solved. The problem occurred again this weekend. Alas I had the monday off so a colleague of mine handled the call but didn't collect any of the information needed in the troubleshooting scenario. I will check the server now each saturday until it fails again and then perform the tests. Thomas

Please also check the regisrty that I had mentioned. And keep me posted on the issue.

Hi Harpreet! Well the IS failed again this weekend as expected. I ran the two diagnostics (dcdiag and netdiag) but no errors were reported so it seems that connectivity and AD is doing allright. No errors are logged apart from the ActiveSync (push mail generated) warnings that indicate that somethingis wrong. To me it looks very much like it is the IS and not the System Attendant. But to be honest I dont' know how to be 100% sure of this. I tried closing down the IS but it hung. Then I forced it down with the taskkill command and started it again afterwards. I then restarteted the System Attendant with no problems (this also restartet the IS). So that's why I think it is the IS. As a test I have now uninstalled all AntiVirus, including the messagingagent (stillprotected by extarnel filter at ISP though) and Iexpect this to run untilnext failure so that AV can be ruled out or pointed at if it doesn't fail again after this. I suspect this to be a failure generated by a routine task being performed on the IS, could very well be AntiVirus software performing some kind of scan, but this I will find out soon. I'll etback to you asap withan update Best Regards Thomas

Hi Thoimas, As you said that the issue is narrowed down to information store, I would suggest if you can have a database check for corruptions present if any. Check out these articles for more information on how to check database for corruption. http://support.microsoft.com/kb/259851http://support.microsoft.com/kb/314917 Let me know if the issue persists again.

Thanks for the links, I'll give 'em a go if the AV scanning is not the problem Best Regards Thomas

Hi Harpreet!I've let the server run now for aprox. a month and everything seems fine. No crashes since I removed the AntiVirus Messaging agent so I seems that the culprithas been found. I'll have to work on finding a way to configure it that doesn't crash the Information Store ;)Thanks foryour help and many replies :)Best RegardsThomas