We created a bunch of new mailboxes for some OWA users on Tuesday. On Wednesday we noticed the mailbox database for those users had grown a lot. Looking into it further, new log files were being generated every second, for no good reason - mailbox sizes were less than 10MB, and no much mail was being generated. Using Exmon, we determined that one mailbox was being hammered by msexchangemailboxassistants.exe (upwards of 30,000 operations per minute, 98% CPU time). I've turned the logging right up for all the mailbox assistants categories, but I can't see any errrors. We've even moved the problem mailbox between databases, to see if it's a corrupt message, but there were none. There are no rules on the mailbox, and no OOF. Exchange is version 14.1.289.6, separate CAS/Mailbox. User has 152 items in the mailbox. Only other thing of note seems to be there's an IPhone synching with the mailbox. Any ideas how we can get to the bottom of what's causing msexchangemailboxassistants.exe to get stuck on this mailbox?

What other clients is he using? Anything outside of outlook such as entourage? Any third party apps such as archiving? Any outlook plug ins? What I would do is have him close his clients one at a time and see if the logs\activity still generate. Have him disable his iphone connection observe, then do the same with his outlook. Also ask him if he's running any clients from a home computer. Have him launch outlook /safe to disable his plug ins.James Chong MCITP | EA | EMA; MCSE | M+, S+ Security+, Project+, ITIL msexchangetips.blogspot.com

So these are only OWA users? No Outlook?

Thanks for the replies guys. Yes, the user only has OWA access, and we've isolated the mailbox from the client side completely to test - the behaviour is still there, and as Exmon shows, the activity is purely on the server, from the mailbox assistants process. It's like the assistant is looping on a processing a particular item, but being such a new mailbox we're at a loss to explain what it could be. Is there any way of seeing exactly what that process is up to inside the mailbox?

Thanks for the replies guys. Yes, the user only has OWA access, and we've isolated the mailbox from the client side completely to test - the behaviour is still there, and as Exmon shows, the activity is purely on the server, from the mailbox assistants process. It's like the assistant is looping on a processing a particular item, but being such a new mailbox we're at a loss to explain what it could be. Is there any way of seeing exactly what that process is up to inside the mailbox? If the increased diags dont show it, then probably not in any easy manner. How soon after creating the mailbox did this start? Anything in the calendar? How about the outbox? ( You can check the outbox via powershell Get-MailboxFolderStatistics) or use OWA Lite.

It was setup Monday night, the user began using it Tiuesday morning, and the first backup failure (DPM) was on Wednesday night, because the mail database had grown so quickly, so suddenly. So I imagine the problem started sometime Wednesday. The user hasn't imported old mail. Nothing in the calendar or outbox. 60 other mailboxes on that server without a problem, including others in the same database, and with 1000s of items. I'm tempted just to export the contents, delete the mailbox and re-import, but not sure how the retention policy is affects mailbox assistants processing, and there's always the danger we'll re-import the problem item. Would rather have a go at trying to figure out what's causing the problem before we try and work around it.

Check the outbox. I'm thinking along the same line of some looping message. Also do the suggestions in Mike Lagase's article, it's the most comprehensive troubleshooting steps out there. get-mailbox -ResultSize Unlimited| Get-MailboxFolderStatistics -folderscope Outbox | Sort-Object Foldersize -Descending | select-object identity,name,foldertype,itemsinfolder,@{Name="FolderSize MB";expression={$_.folderSize.toMB()}} | export-csv OutboxItems.csv Troubleshooting Exchange 2007 Store Log/Database growth issues http://blogs.technet.com/b/mikelag/archive/2009/07/12/troubleshooting-store-log-database-growth-issues.aspx You can also parse the transaction logs to see what the recurring instances are but sometimes it's just gobly gook. “Rough and Tough” guide to identifying patterns in Transaction Logs http://blogs.msdn.com/b/scottos/archive/2007/07/12/rough-and-tough-guide-to-identifying-patterns-in-ese-transaction-log-files.aspx Last solution that some users do is just re-create the mailbox if you can't isolate the issue (not just move) and import the exported pst. James Chong MCITP | EA | EMA; MCSE | M+, S+ Security+, Project+, ITIL msexchangetips.blogspot.com

It was setup Monday night, the user began using it Tiuesday morning, and the first backup failure (DPM) was on Wednesday night, because the mail database had grown so quickly, so suddenly. So I imagine the problem started sometime Wednesday. The user hasn't imported old mail. Nothing in the calendar or outbox. 60 other mailboxes on that server without a problem, including others in the same database, and with 1000s of items. I'm tempted just to export the contents, delete the mailbox and re-import, but not sure how the retention policy is affects mailbox assistants processing, and there's always the danger we'll re-import the problem item. Would rather have a go at trying to figure out what's causing the problem before we try and work around it. This 2010 SP1 yes? Why not run New-MailboxRepairRequest against this mailbox and see if that fixes it. http://technet.microsoft.com/en-us/library/ff625226.aspx

Check the outbox. I'm thinking along the same line of some looping message. Also do the suggestions in Mike Lagase's article, it's the most comprehensive troubleshooting steps out there. get-mailbox -ResultSize Unlimited| Get-MailboxFolderStatistics -folderscope Outbox | Sort-Object Foldersize -Descending | select-object identity,name,foldertype,itemsinfolder,@{Name="FolderSize MB";expression={$_.folderSize.toMB()}} | export-csv OutboxItems.csv Troubleshooting Exchange 2007 Store Log/Database growth issues http://blogs.technet.com/b/mikelag/archive/2009/07/12/troubleshooting-store-log-database-growth-issues.aspx You can also parse the transaction logs to see what the recurring instances are but sometimes it's just gobly gook. “Rough and Tough” guide to identifying patterns in Transaction Logs http://blogs.msdn.com/b/scottos/archive/2007/07/12/rough-and-tough-guide-to-identifying-patterns-in-ese-transaction-log-files.aspx Last James Chong MCITP | EA | EMA; MCSE | M+, S+ Security+, Project+, ITIL msexchangetips.blogspot.com

Didn't fix it - no problems detected for any corruption types.

The outbox came back with: #TYPE Selected.Microsoft.Exchange.Management.Tasks.MailboxFolderConfiguration "Identity","Name","FolderType","ItemsInFolder","FolderSize MB" "domain/OU/OU/Firstname Lastname\Outbox","Outbox","Outbox","1","0" I'm guessing this means there's 1 item in the outbox with zero size? possibly the problem, as it didn't show up in the OWA lite version. So how do we get rid of it?

Should be 0, but I tested against my mailbox and shows 1 also even nothing in my outbox. I sampled test account shows 0 and sampled a few other mailboxes and shows mixes of 1 and 0. mfcmapi didn't show anything in my outbox but I went ahead and did a right click, empty items and subfolders and had to chose both del_Assocated and hard deletion to get it back to 0. You can try it out and see if it helps.James Chong MCITP | EA | EMA; MCSE | M+, S+ Security+, Project+, ITIL msexchangetips.blogspot.com

The outbox came back with: #TYPE Selected.Microsoft.Exchange.Management.Tasks.MailboxFolderConfiguration "Identity","Name","FolderType","ItemsInFolder","FolderSize MB" "domain/OU/OU/Firstname Lastname\Outbox","Outbox","Outbox","1","0" I'm guessing this means there's 1 item in the outbox with zero size? possibly the problem, as it didn't show up in the OWA lite version. So how do we get rid of it? I bet you find a lot of mailboxes with more than 0 in the outbox. I would be suprised if you actually had any items there since you arent using Outlook in cache mode.

Yeah, Outbox appears to be a dead end. I'll do some log analysis.

Yeah, Outbox appears to be a dead end. I'll do some log analysis. I'm thinking creating the mailbox is the quickest solution however, though I know you want to know what it could be for the next time. From my experience, these are usually one-offs. By that I mean, you can analyze the logs and find out that some specific message is causing it but the next time it may be a PDA or a malformed calendar entry etc...