I have recently congifured new exchage server 2007 sd. edition x64everything was working fine. Today morning Outlook was showing disconnected, when i checked mailbox store and Public Store was dismounted. There was 1.6GB free space on the drive. I moved few logs file from the parition and started the store everything started working again. I have found following errors in the event log. Event Type:WarningEvent Source:MSExchange ActiveSyncEvent Category:Requests Event ID:1022Date:20-Aug-09Time:10:23:51 AMUser:N/AComputer:MDSDescription:The connection between the Client Access server and Mailbox server "mds.makers.local" failed. If this event is logged infrequently or only during scheduled downtime for a Mailbox server, no user action is required. If this event occurs repeatedly, check network connectivity using PING or PingPath. Also, check connectivity using the Test-ActiveSyncConnectivity cmdlet. More information: Microsoft.Exchange.Data.Storage.ConnectionFailedTransientException: Cannot open mailbox /o=Makers/ou=Exchange Administrative Group (FYDIBOHF23SPDLT)/cn=Recipients/cn=puneet. ---> Microsoft.Mapi.MapiExceptionLogonFailed: MapiExceptionLogonFailed: Unable to open message store. (hr=0x80040111, ec=-2147221231)Diagnostic context: Lid: 18969 EcDoRpcExt2 called [length=696] Lid: 27161 EcDoRpcExt2 returned [ec=0x0][length=132][latency=0] Lid: 23226 --- ROP Parse Start --- Lid: 27962 ROP: ropLogon [254] Lid: 17082 ROP Error: 0x80040111 Lid: 26937 Lid: 21921 StoreEc: 0x80040111 Lid: 27962 ROP: ropExtendedError [250] Lid: 1494 ---- Remote Context Beg ---- Lid: 26426 ROP: ropLogon [254] Lid: 22787 Error: 0x0 Lid: 13032 StoreEc: 0x8004010F Lid: 59409 Lid: 45073 Lid: 11173 StoreEc: 0x80040111 Lid: 22970 Lid: 8620 StoreEc: 0x80040111 Lid: 1750 ---- Remote Context End ---- Lid: 26849 Lid: 21817 ROP Failure: 0x80040111 Lid: 26297 Lid: 16585 StoreEc: 0x80040111 Lid: 32441 Lid: 1706 StoreEc: 0x80040111 Lid: 24761 Lid: 20665 StoreEc: 0x80040111 Lid: 25785 Lid: 29881 StoreEc: 0x80040111 at Microsoft.Mapi.MapiExceptionHelper.ThrowIfError(String message, Int32 hresult, Int32 ec, DiagnosticContext diagCtx) at Microsoft.Mapi.ExRpcConnection.OpenMsgStore(OpenStoreFlag storeFlags, String mailboxDn, Guid mailboxGuid, Guid mdbGuid, MapiStore msgStorePrivate, String& correctServerDn, ClientIdentityInfo clientIdentityAs, String userDnAs, String applicationId, CultureInfo cultureInfo) at Microsoft.Mapi.ConnectionCache.OpenMapiStore(String mailboxDn, Guid mailboxGuid, Guid mdbGuid, ClientIdentityInfo clientIdentity, String userDnAs, OpenStoreFlag openStoreFlags, CultureInfo cultureInfo, String applicationId) at Microsoft.Mapi.ConnectionCache.OpenMailbox(String mailboxDn, Guid mailboxGuid, Guid mdbGuid, WindowsIdentity windowsIdentityAs, String userDnAs, OpenStoreFlag openStoreFlags, CultureInfo cultureInfo, String applicationId) at Microsoft.Exchange.Data.Storage.ConnectionCachePool.OpenMailbox(String serverDn, String userDn, String mailboxDn, Guid mailboxGuid, Guid mdbGuid, Object identity, ConnectFlag connectFlag, OpenStoreFlag openStoreFlag, CultureInfo cultureInfo, String clientInfoString, Boolean secondTry) --- End of inner exception stack trace --- at Microsoft.Exchange.Data.Storage.ConnectionCachePool.OpenMailbox(String serverDn, String userDn, String mailboxDn, Guid mailboxGuid, Guid mdbGuid, Object identity, ConnectFlag connectFlag, OpenStoreFlag openStoreFlag, CultureInfo cultureInfo, String clientInfoString, Boolean secondTry) at Microsoft.Exchange.Data.Storage.ConnectionCachePool.OpenMailbox(String serverDn, String userDn, String mailboxDn, Guid mailboxGuid, Guid mdbGuid, Object identity, ConnectFlag connectFlag, OpenStoreFlag openStoreFlag, CultureInfo cultureInfo, String clientInfoString, Boolean secondTry) at Microsoft.Exchange.Data.Storage.ConnectionCachePool.OpenMailbox(String serverDn, String userDn, String mailboxDn, Guid mailboxGuid, Guid mdbGuid, Object identity, ConnectFlag connectFlag, OpenStoreFlag openStoreFlag, CultureInfo cultureInfo, String clientInfoString) at Microsoft.Exchange.Data.Storage.MailboxSession.Initialize(LogonType logonType, ExchangePrincipal owner, DelegateLogonUser delegateUser, Object identity, OpenMailboxSessionFlags flags) at Microsoft.Exchange.Data.Storage.MailboxSession.CreateMailboxSession(LogonType logonType, ExchangePrincipal owner, DelegateLogonUser delegateUser, Object identity, OpenMailboxSessionFlags flags, CultureInfo cultureInfo, String clientInfoString) at Microsoft.Exchange.Data.Storage.MailboxSession.Open(ExchangePrincipal mailboxOwner, WindowsPrincipal authenticatedUser, CultureInfo cultureInfo, String clientInfoString) at Microsoft.Exchange.AirSync.Command.OpenMailboxSession(AirSyncUser user) at Microsoft.Exchange.AirSync.Command.WorkerThread() For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.Event Type:WarningEvent Source:MSExchangeTransportEvent Category:TransportService Event ID:12023Date:20-Aug-09Time:10:58:40 AMUser:N/AComputer:MDSDescription:Microsoft Exchange could not load the certificate with thumbprint of 001FB122A7ABB6A2DB7B43A1F586FBF7DB09B9F7 from the personal store on the local computer. This certificate was configured for authentication with other Exchange servers. Mail flow to other Exchange servers could be affected by this error. If the certificate with this thumbprint still exists in the personal store, run Enable-ExchangeCertificate 001FB122A7ABB6A2DB7B43A1F586FBF7DB09B9F7 -Services SMTP to resolve the issue. If the certificate does not exist in the personal store, restore it from backup by using the Import-ExchangeCertificate cmdlet, or create a new certificate for the FQDN or the server enabled for SMTP by running the following command: New-ExchangeCertificate -DomainName serverfqdn -Services SMTP. Meanwhile, the certificate with thumbprint EF38D0D29B4FC0206704EF867616ECFF1FAFD097 is being used. Can anyone help me to identify the problem. Was it because of disk space or something else. One more thing I have noticed that every second 15 log files are created for both first storage group and secondary storage group. how do i avoid doing the same. Thanks,NzmNzm

Can you post errors instead of warning coming in event log of Exchange server? Also run ExBPA and see if you get any PF DB related error... Amit Tank | MVP Exchange Server | MCITP: EMA | MCSA: M | http://ExchangeShare.WordPress.com

There are no otehr error except these warnings. I run ExBPA it says 'Databse Backup Critical' ' Database 'Mailbox Database' on server MDS contains 100 mailboxes. This database has never had a full online backup.Other than this is TCPIP.SYS driver warning and it says Microsoft filter pack is not installed. There are no wother errors.I need to know that teh mailbox store dismounted because of the space on the partition, there was 1.6Gb free space that time. I have made 4Gb free now. Any other data which I can provide you.If I have to take online exchaneg back shoudl I use Windows NT backup for Exchange 2007 or any otehr 3rd party application what do you recommend.Tthanks,Nzm Nzm

1.6 GB is good enough space to keep database mounted. Doesn't it show any error during the time of mailbox dismounted? Couple of things to clear out... Is Exchange database and Transaction logs stored in same partition? Yes, you can use NTBackup if Exchange is running on Windows 2003 server but if it is Windows 2008 server then you need to use some thirdparty backup software because it doesn't have NTBackup Exchange aware. Take full backup of Exchange server and see how much space you cleared out, all transaction logs should be purged then. Also keep a best practice to have full backup of Exchange server once in a week so it will purge the transaction logs... Amit Tank | MVP Exchange Server | MCITP: EMA | MCSA: M | http://ExchangeShare.WordPress.com

yes Exchange Databse and Transaction log are on te same partition. Is it fine or you have some suggestions. I have windows server 2002 so I can run NT Backup. I'll follow your instrcution and see if the problem occure again. What about the certificate warnign taht is coming which I hve mentioned in the first post. You have any suggestions on it.Regards,NzmNzm

Yes, it would be better if you keep DB and Transaction Logs onseparatedrive from performance prospective. About certificate, can you run Get-ExchangeCertificate | FL cmdlet and post the output here? Looks like SMTP service is not attached with valid certificate...Amit Tank | MVP Exchange Server | MCITP: EMA | MCSA: M | http://ExchangeShare.WordPress.com

Hi MAit,My database dismounted again. System was givign low disk space on exchange partition. I am moving the log files again. In the mornign I freed up 4Gb it got full so fast. Is there anything wrong. Exchaneg it creating 15 log file in every second. I am creating mroe disk space rigt nwo and will try to mout the databse again. after taht immedietely i am going to put nt backup. Will there be perfrmance issue if I do the backup right now as users are currenly working on it.Regards,NzmNzm

You can move the logs which are not committed to database with below method and take backup once it is finished. Move Committed Exchange Transaction Logs http://exchangeshare.wordpress.com/2008/05/22/move-committed-exchange-transaction-logs/ Do you have file level antivirus installed on Exchange server? If so, make sure that exchange directory properlyexcludedas per below article... File-Level Antivirus Scanning on Exchange 2007 http://technet.microsoft.com/en-us/library/bb332342.aspx Refer below article for the troubleshooting fast growing transaction logs... Troubleshooting Exchange 2007 Store Log/Database growth issues http://blogs.technet.com/mikelag/archive/2009/07/12/troubleshooting-store-log-database-growth-issues.aspx Amit Tank | MVP Exchange Server | MCITP: EMA | MCSA: M | http://ExchangeShare.WordPress.com

I have gone through the links you have provided. Exchange User Monitor says that NT AUTHORITY\NETWORK SERVICE is utilizing maximum CPU resources. I can not stop or block this user. As the same time I have run the test which was given in the link which it didn't help me in any manner. One thing I would like bring to your notice that in the link its mentioned that 'Its possible that a user imported a lot of data from a PST file which could cause log growth server side'. This is what we have done. A week back w have imported pst from our old exchange 2003 server to this new server using exmerge. This could be cause of te problem. How do i rectify the same.Regards,NzmNzm

I hope you have downloaded ExMon for Exchange 2007... -http://msexchangeteam.com/archive/2009/04/22/451137.aspx Yes, PST import can increase the transaction log generation but at the time of import, not after a week. Importing data isultimately considered as transaction so it generates logs... Suggest you to clear out the log by moving it and taking full backup. Also make a backup policy like take full backup once in a week and Incremental backup daily or etc... based on your requirement. Monitor the transaction log growth for a day and see how many logs generated...Amit Tank | MVP Exchange Server | MCITP: EMA | MCSA: M | http://ExchangeShare.WordPress.com

I have downloaded ExMon and it shows NT AUTHORITY\NETWORK SERVICE user utilizing 78% of CPU. I excluded Exchange folder from my Antivirus. I have taken full backup which consilidated the log files. Now my transaction log shows todays log only. from 2:06pm till 7:44pm it has generated 172 files on first storage group and on second storage group from 5:00pm till 8:11pm it has generated 8217 files. Second Storage group is the public folder where I have set Journaling to Archive all incoming and out going emails. I have disabled the ARchival right now and will check. Do you think 172 files generation in 6 hours for first storage group is justify figure. I have approximately 100 mailboxes in my exchange store.Regards,NzmNzm

Ahh, archiving! that should be the problem because as it was never backed up so transaction log files never purged... And archiving on PF! side note, it is not recommended to use PF for archiving destination... :) About 172MB of log file generation is totally depends on the usage of users, it could be and couldn't be also, but message tracking can give you better idea... I would suggest you to monitor for a day since you have already disabled archiving that should give you better idea. Amit Tank | MVP Exchange Server | MCITP: EMA | MCSA: M | http://ExchangeShare.WordPress.com

After disabling Archival from Public Folder (Secondary Storage Group), I have schedule Exchange database backupat 4:00am in the morning. From 4:00am till 11:00am there were 16600 log file got generated. Where as Primary Storage Group only 120 file. That means even ater disbaling Archival Secondary Storage is generating huge logs. How to prevent doing it Shoudl I delete and recreate secondary storage as I just have single contatc folder in PF whic has 1500 conatcts. If recreating the storage is the right solution can you help me with the exac procedure please.Regards,NzmNzm

I have deleted the ARchival folder from PF and the problem sorted out. I need a keep a record of incoming and outgoing email transaction of teh organization, tell me what is the best way to do the same.As per the earlier post belwo is the detail of Get-ExchangeCertificate | FL AccessRules : {System.Security.AccessControl.CryptoKeyAccessRule, System .Security.AccessControl.CryptoKeyAccessRule}CertificateDomains : {externaldomain.com}HasPrivateKey : TrueIsSelfSigned : FalseIssuer : CN=mds, DC=makers, DC=localNotAfter : 22-Jul-11 4:15:48 PMNotBefore : 22-Jul-09 4:15:48 PMPublicKeySize : 1024RootCAType : RegistrySerialNumber : 6134FA8F000000000004Services : IISStatus : ValidSubject : CN=externaldomain, OU=Users, O=SBL, L=Mumbai, S=Ma harashtra, C=INThumbprint : 5C7F2106EECF77E4B17A416443BF81666B566D61 AccessRules : {System.Security.AccessControl.CryptoKeyAccessRule, System .Security.AccessControl.CryptoKeyAccessRule}CertificateDomains : {mds}HasPrivateKey : TrueIsSelfSigned : FalseIssuer : CN=server, DC=internal, DC=localNotAfter : 22-Jul-11 3:51:47 PMNotBefore : 22-Jul-09 3:51:47 PMPublicKeySize : 1024RootCAType : RegistrySerialNumber : 611EFEA1000000000003Services : NoneStatus : ValidSubject : CN=server, OU=Users, O=SBL, L=Mumbai, S=Maharashtra, C=INThumbprint : 8AE58B7E042C8AE9BC0273BB1EA930F2184909E7 AccessRules : {System.Security.AccessControl.CryptoKeyAccessRule, System .Security.AccessControl.CryptoKeyAccessRule, System.Securi ty.AccessControl.CryptoKeyAccessRule}CertificateDomains : {server, server.internal.local}HasPrivateKey : TrueIsSelfSigned : TrueIssuer : CN=serverNotAfter : 21-Jul-10 4:27:24 PMNotBefore : 21-Jul-09 4:27:24 PMPublicKeySize : 2048RootCAType : RegistrySerialNumber : 5F901DBC4884EA9946D50E428F908293Services : IMAP, POP, UM, SMTPStatus : ValidSubject : CN=serverThumbprint : EF38D0D29B4FC0206704EF867616ECFF1FAFD097 AccessRules : {System.Security.AccessControl.CryptoKeyAccessRule, System .Security.AccessControl.CryptoKeyAccessRule}CertificateDomains : {server.internal.local}HasPrivateKey : TrueIsSelfSigned : FalseIssuer : CN=server, DC=internal, DC=localNotAfter : 21-Jul-10 3:18:20 PMNotBefore : 21-Jul-09 3:18:20 PMPublicKeySize : 1024RootCAType : RegistrySerialNumber : 61013DB0000000000002Services : IMAP, POP, UMStatus : ValidSubject : CN=server.internal.localThumbprint : 001FB122A7ABB6A2DB7B43A1F586FBF7DB09B9F7 AccessRules : {System.Security.AccessControl.CryptoKeyAccessRule, System .Security.AccessControl.CryptoKeyAccessRule}CertificateDomains : {mds}HasPrivateKey : TrueIsSelfSigned : TrueIssuer : CN=serevr, DC=internal, DC=localNotAfter : 21-Jul-19 2:31:43 PMNotBefore : 21-Jul-09 2:31:43 PMPublicKeySize : 2048RootCAType : RegistrySerialNumber : 1DD1FCC87F82B3A14EBACC54D74EF3C4Services : NoneStatus : ValidSubject : CN=server, DC=internal, DC=localThumbprint : E97E4BC8D8126B22F7472A749D448BB3FFF1C2CD NzmNzm

How did you configure the archiving? Byspecifying PF in database properties -> general tab ->Journal Recipient ? If so, is itenabledon PF database also? Because journal recipient resides on PF and journaling is enabled on PF database then it creates a loop and I guess that would be the case of transaction log generation... Now, create a new storage group and a mailbox database inside(don't enable journal on database properties), create a mailbox named Archive or Journal and set this new mailbox as a Journal Recipient to save all incoming/outgoing mails. You can set transaction log path toseparate drive. Make sure that you have configured to take full backup once in a week and daily incremental at least for this new storage group... About certificate, I see you have a third-party certificate with thumbprint001FB122A7ABB6A2DB7B43A1F586FBF7DB09B9F7 but SMTP service is not attached with it so you can run below cmdlet to attach it... Enable-ExchangeCertificate -ThumbPrint001FB122A7ABB6A2DB7B43A1F586FBF7DB09B9F7 -Services "IMAP, POP, UM, SMTP"Amit Tank | MVP Exchange Server | MCITP: EMA | MCSA: M | http://ExchangeShare.WordPress.com

Thank you very much Amit for all your support.Will try the same for archival.Thanks a lot.NzmNzm

You're welcome! :)Amit Tank | MVP Exchange Server | MCITP: EMA | MCSA: M | http://ExchangeShare.WordPress.com