Frontend transport service crashes while processing data from some external clients

Hi,

I have an Exchange Server 2013 Standard Version 15, Build 516.32 running in a production environment.  The server runs in a VM hosted by a Hyper V server version 6.2.9200.16579 . For the moment we rely on the builtin Anti-Spam protection which is enabled and working. The Anti-Malware is disabled.

Problem: I noticed that every few hours the FrontEnd Transport Service keeps crashing and restarting on the below events. It is coming back like a train precision, every 1-2 hours. The common piece is the IP range of the client generating the service crash/restart, mostly there are two IPs that keep showing on. Upon checking the IPs via mx toolbox (external blacklist check) I found that at least one of the IPs are listed on RBL as blackscatterer and other SPAMming patterns. 

Even so being, I do not find it normal to crash the service every time as such. What could be done? Do you think I should apply the latest Exchange CU2? Thank you, Cristian

7031 (system)
The Microsoft Exchange Frontend Transport service terminated unexpectedly.  It has done this 1 time(s).  The following corrective action will be taken in 5000 milliseconds: Restart the service.

1033 (app)
An exception was thrown while processing data from client IP address 207.126.144.140. The exception is System.ObjectDisposedException: Cannot access a closed Stream.
   at System.IO.MemoryStream.Write(Byte[] buffer, Int32 offset, Int32 count)
   at Microsoft.Exchange.Protocols.Smtp.SmtpInDataProxyParser.ParseAndWrite(Byte[] data, Int32 offset, Int32 numBytes, Int32& numBytesConsumed)
   at Microsoft.Exchange.Protocols.Smtp.DataInboundProxySmtpCommand.RawDataReceived(Byte[] data, Int32 offset, Int32 numBytes)
   at Microsoft.Exchange.Protocols.Smtp.SmtpInSession.ReadComplete(IAsyncResult asyncResult).

499 (App)
Watson report about to be sent for process id: 10216, with parameters: E12, c-RTL-AMD64, 15.00.0516.032, MSExchangeFrontendTransport, M.Exchange.Transport, M.E.P.S.SmtpInDataProxyParser.ParseAndWrite, System.ObjectDisposedException, cde8, 15.00.0516.030.
ErrorReportingEnabled: True

September 17th, 2013 6:07am

Hello Cristian,

First, I suggest you restart the Front End Transport service and Transport service to check the result.

Secondly, please temporarily disable anti-spam agent to check the result.

Besides, I recommend you install exchange 2013 CU2 to check the result.

Hope this helps.

Best regards,
Belinda

Free Windows Admin Tool Kit Click here and download it now
September 18th, 2013 3:03am

Thank you, Belinda.

Restarting the Transport services has no effect in this context. The events in question keep coming once every few hours.

Hmm, disabling the Anti-Spam would open the flood gates to Spam.

I am going to try to update to CU2 and keep fingers crossed.

Cristian

September 18th, 2013 11:15am

Cristian,

Did updating to CU2 and turning off the Anti-Spam filter solve the issues you have been having?

I have been experiencing the same symptoms on my company's Exchange Server.  Looking for some solutions.

Thanks.

Marv

Free Windows Admin Tool Kit Click here and download it now
September 26th, 2013 2:40pm

Hi, Marv.

I am still at Build 516.32, did not turn off Anti-Spam, but the respective events are gone , at least for the last couple of days. The only thing which I did was tweaking with various anti-spam settings, such as:

set-senderidconfig -spoofeddomainaction stampstatus (previously delete)  

set-contentfilterconfig -SCLrejectenabled $false

set-contentfilterConfig -SCLdeleteenabled $false

I am not sure if this has made the trick, or it is the spamming sources that moved elsewhere. Still I consider this behavior as a malfunction. 

Nevertheless I am still contemplating the CU2 update. Did you update your server meanwhile? Any problems after updating?

Ciao,

Cristian 

October 10th, 2013 10:17am

This topic is archived. No further replies will be accepted.

Other recent topics Other recent topics