Good Day Everyone, We have an Exchange 2003 cluster (two physical servers with a virtual IP front end) that was responding to SMTP request in about 200msec. As of last week that time has spiked up to around 40,000msec. We noticed (in the event log) SPAM attempts that were failing, but it wasn't enough activity to create such a response delay. We've blocked the SPAM'ers IP addresses at the Edge, but nothing has changed. Any ideas of what other tools i can use to isolate the problem? thanks in advance.Raymond Soto Jr. MCP

Do you have any errors in teh evnt log? You can monitor perforance using the perfwiz for Exchange.

No errors in the event log. We've been monitoring response time for a long time, so looking back at historical data I've come realize the increase in response time correlates to the time we add an Exchange 2010 server. Mail flows between both environments with no issue (minus the increased response time). Does Exchange 2010 and 2003 in co-existence mode increase SMTP response times?Raymond Soto Jr. MCP

Does Exchange 2010 and 2003 in co-existence mode increase SMTP response times? No. Please provide more details. Is the email from internet to 2010 or 2003 delayed or vice evrsa. Which Exchange version is hosting the connector to Internet. The delay might be due to several reasons. If you have multiple hops between source and destination. How many routing groups do you have in Exchnage 2003 and are they across WAN. May be you need to create additional routing group coneectors between 2003 and 2010

Thanks for the quick feedback! The testing of SMTP response time is internal on the same LAN(internal mailbox sending to internal mailbox) (only one routing group). Again before adding 2010 the response time was 200msec. the test email is being sent from a server on the same LAN to the Exchange 2003 server and routed to the Exchange 2010 server. Thanks again for the ideas!Raymond Soto Jr. MCP

On Wed, 24 Aug 2011 15:59:29 +0000, RaymondSotoJr wrote: > > >Thanks for the quick feedback! > >The testing of SMTP response time is internal on the same LAN(internal mailbox sending to internal mailbox) (only one routing group). Again before adding 2010 the response time was 200msec. > >the test email is being sent from a server on the same LAN to the Exchange 2003 server and routed to the Exchange 2010 server. What are you measuring? Are you sending mail TO an Exchange 2010 server, or FROM an Exchange 2010 server? Are you measuring how long it takes between the receipt of any command and the sending of a response, or are you measuring the time for just a particular command? You may be looking at "shadow redundancy" timeouts. See this link: http://technet.microsoft.com/en-us/library/dd351091.aspx --- Rich Matheisen MCSE+I, Exchange MVP --- Rich Matheisen MCSE+I, Exchange MVP

any update?--------Abhi----------------- Exchange Specialist------------- ------------------ Please remember to click Mark as Answer on the post that helps you, and to click Unmark as Answer if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.

I thought the post above was clear. The mail is internal from mailbox on 2003 server to mailbox on 2003 server. In fact after your posting we added other testing end points and found the response time is the same when mail goes through 2003 to a mailbox on 2010...but when mail goes through the 2010 HUB to a mailbox on 2003 the respon time is 800msec (after disabling Tarpitting). As for an update we found Symantec mail security version 5 was conflicting in some way with the Exchange SMTP connection filtering. When we unchecked the SMTP connection filtering (on the SMTP virtual server within the ESM) we were able to drop the SMTP response time to 14,000msec (still bad, but a big difference). Given all this started when adding a 2010 Exchange to the environment we are leaning towards an issue with Symantec scanning the SMTP connector between 2003 and 2010. Will update when we get feedback from Symantec. Raymond Soto Jr. MCP

On Thu, 25 Aug 2011 12:35:51 +0000, RaymondSotoJr wrote: >I thought the post above was clear. Actually, it wasn't. It was wordy, but: "The testing of SMTP response time is internal on the same LAN(internal mailbox sending to internal mailbox) (only one routing group). Again before adding 2010 the response time was 200msec." No mention of any Exchange release in there. No mention of whether you were measuring things from the time the HELO\EHLO was sent until the final 250 at the end of the message, or if you were measuring the time between receiving a command and the time a response was sent. Not much information there at all. If the messages are sent between two Exchange 2003 servers then the 2010 server shouldn't be involved at all since its in a different routing group. And this (below) doesn't actually say if the "server on the same LAN" was seeing long response times from Exchange 2003 or if it was 2003 that was getting slow responses from 2010. "the test email is being sent from a server on the same LAN to the Exchange 2003 server and routed to the Exchange 2010 server. " >The mail is internal from mailbox on 2003 server to mailbox on 2003 server. In fact after your posting we added other testing end points and found the response time is the same when mail goes through 2003 to a mailbox on 2010...but when mail goes through the 2010 HUB to a mailbox on 2003 the respon time is 800msec (after disabling Tarpitting). Did you visit the link I included in my last reply? Sending mail FROM 2003 TO 2010 will get a delayed acknowledgement. Sending mail from 2010 to 2003 should go as fast as the 2003 server can process the data stream. >As for an update we found Symantec mail security version 5 was conflicting in some way with the Exchange SMTP connection filtering. When we unchecked the SMTP connection filtering (on the SMTP virtual server within the ESM) we were able to drop the SMTP response time to 14,000msec (still bad, but a big difference). 14 seconds is awful. But how introducing Exchange 2010 into an organization would affect Exchange 2003 I don't know -- unless the 3rd-party software doesn't like some of the SMTP commands. >Given all this started when adding a 2010 Exchange to the environment we are leaning towards an issue with Symantec scanning the SMTP connector between 2003 and 2010. If it's running on Exchange 2003 I'd guess there's no way that it wouldn't. --- Rich Matheisen MCSE+I, Exchange MVP --- Rich Matheisen MCSE+I, Exchange MVP

WOW...you are very smart. Thank you for all your help!Raymond Soto Jr. MCP

mark as answer to close--------Abhi----------------- Exchange Specialist------------- ------------------ Please remember to click Mark as Answer on the post that helps you. This can be beneficial to other community members reading the thread.

the problem has not been solved...no one has given a suggestion that is even close. I'm in the process of creating a Co-Existence lab to test SMTP response times. This lab will have an Exchange 2003 environment and a connector to a 2010 environment (just like our production site). I hope to have some more answers within the next 48 hours.Raymond Soto Jr. MCP

On Fri, 26 Aug 2011 14:55:44 +0000, RaymondSotoJr wrote: >the problem has not been solved...no one has given a suggestion that is even close. How can they, given such a scant amount of information? --- Rich Matheisen MCSE+I, Exchange MVP --- Rich Matheisen MCSE+I, Exchange MVP

On Fri, 26 Aug 2011 12:29:06 +0000, RaymondSotoJr wrote: >WOW...you are very smart. Maybe, but I think you're just being sarcastic to cover up you lack of diagnostic abilities. --- Rich Matheisen MCSE+I, Exchange MVP --- Rich Matheisen MCSE+I, Exchange MVP

We discovered the problem. The issue was Symantec mail gateway security had an RBL entry that wasn't online. When mail was sent through the Exchange 2003 server Symantec would run an RBL check (yes on every piece of mail (old version of the software)). Since the RBL server being used was offline Symantec would hold the mail for 40 seconds before allowing it to move on. The delay in Eschange 2010 was infact Tarpiiting which was 5 seconds by default. Thanks for everyones help. Raymond Soto Jr. MCP