I am troubleshooting some heavy MAPI activity on our Exchange 2007 CCR cluster. ExMon is showing user "?" has a very high MAPI utilization. The IPs it shows are the IP addresses of our hub transport servers (we have two). My question is what user is user "?". It actually shows a question mark for this user and it consistantly about 30% of the MAPI load. We have Symantec Mail Security for Exchange installed on the hub transport servers, but I have disabled it and this is still an issue.

Well, Exchange 2007 version of ExMon is not really available yet. v06.05.7543 released in 2005 and same version published on 03/31/09 so wait for gotcha to be corrected at download link. ExMon released (no joke!) http://blogs.3sharp.com/deving/archive/2009/04/01/exmon-released-no-joke.aspx Meanwhile you may need to use some alternatives like ExInsight -http://bitrunes.com/Amit Tank | MVP - Exchange | MCITP:EMA MCSA:M | http://ExchangeShare.WordPress.com

Well, the version I have was obtained from MS support via a PSS case. Additionally, the Exchange Troubleshooting Assistant seems to use some version of the tool for its data collection.

Have you been able to identify the users? Sometimes if you open up the log files with Notepad you may see the user name reoccuring over and over and over. How many connections is the user establishing?I have seen in the past that a plug in on the users desktop will try to index their inbox on the exchange server. This can cause a high level of connections (40,000 in this case) and can cause DOS attackes on the Exchange Server.You can throttle the connections: http://technet.microsoft.com/en-us/library/cc540454.aspxBP

I can't guarantee that someone out there doesn't have an indexing tool running, but i would think that it would show up as MAPI traffic coming from that specific user. ExMon is showing me that the user with all the traffic is "?"....yes a question mark. Additionally, ExMon shows that the traffic is being generated from two other exchange 2k7 servers, both of which have hub and cas roles installed

Have you looked at Perf Mon to look at your queues and number of msgs being submitted, delivered, sent per sec?BP

Yes i have. I have sent numbers at .3-.4 sent/sec and receive/sec steady at .4. That doesn't seem overly busy to me.

There is also a monitor to view the number of RPC connections to the mailbox server. Exchange RPC CountersWhen a MAPI client is used to connect to the Exchange Server, client actions translate to remote procedure calls (RPCs) between the client machine and the Exchange Server. The Microsoft Exchange Information Store service, by default, can service a maximum of one hundred simultaneous RPC requests. RPC ConnectionsThe maximum number of concurrent MAPI RPC requests allowed to the Microsoft Exchange Information Store Service. This value should remain below 30 in most Exchange environments. Average RPC Latency (ms)The RPC latency in milliseconds, averaged for the past 1024 packets. The Average RPC Latency (ms) counter indicates the average time taken by the Exchange Server to service a single RPC request. This value should remain below 50 ms in most environments See what happens when you monitor those to give you an idea on how many connections. I think the average per user is around 40.BP