Announcement

Collapse
No announcement yet.

Exchange needs Reboot

Collapse
X
  • Filter
  • Time
  • Show
Clear All
new posts

  • Exchange needs Reboot

    exchange 2003 r2 sp2 requires a reboot every third day. Initially it required a reboot once a week. As per the suggesstions from some previous posts I applied the available required updates , ran exbpa and corrected the problems. now my exchange requires a reboot every third day.

    event logs normal. just one scsi drive related error.

    As per a suggestion from Mr. Dean T. Uemura I stopped the following Antivirus services on my exchange server.

    Trend Micro Client/Server Security Agent Listener
    Trend Micro Client/Server Security Agent Personal Firewall
    Trend Micro Client/Server Security Agent Proxy Service
    Trend Micro Client/Server Security Agent RealTime Scan
    Trend Micro Messaging Security Agent EUQ Monitor
    Trend Micro Messaging Security Agent Master Service
    Trend Micro Messaging Security Agent Remote Configuration Server
    Trend Micro Messaging Security Agent System Watcher
    Trend Micro Unauthorized Change Prevention Service

    Stopping the services was a "Home Run". Exchange was up and running the next day when it was supposed to be off. no mail flow issues. users are able to login normally. i started the anti virus services that I stopped yesterday.

    we are using Trend Micro Worry-Free Business Security Advanced version 5.1 .

    1. now can you please advice how do I breakdown this issue further.

    2. also from the above list of services can you let me know which are the services related to exchange and which are used by o/s. next time I will try just stopping the exchange related antivirus services.

    An update to the current situation.
    exchange needed a reeboot on saturday, then again required a reboot on monday, since I disabled antivirus on tuesday, it did not require a reboot on wednesday. but it required a reboot on thursday instead of wednesday. so any ideas what AV is upto and why exchange is sinking in !

  • #2
    Re: Exchange needs Reboot

    so what exactly happens with exchange that it requires a reboot ?
    Please do show your appreciation to those who assist you by leaving Rep Point https://www.petri.com/forums/core/im.../icon_beer.gif

    Comment


    • #3
      Re: Exchange needs Reboot

      all the emails are stuck up in the queues. even the emails intended for local delivery. in short mail flow stops for both incoming and outgoing emails.

      incoming emails arrive at the server and get stuck up there in the queues.
      outgoing emails too are stuck up in the queues

      users are unable to login via owa both within the organization and out of the organization. when they enter userid and password the screen goes nowhere. local outlook clients does not receive new mails.

      I restarted the smtp service and iis services but of no use.

      when I make a restart everthing goes on normally for the next 48 hours

      FYI: i can ping to the exchange server from the local machines and even use the remote desktop to connect to exchange when the exchange is in the problem state
      Last edited by freakinup4u; 6th May 2010, 07:52. Reason: extra content added

      Comment


      • #4
        Re: Exchange needs Reboot

        and disabling all the Trend services helps alleviate (but does not entirely resolve) the issue ?
        Please do show your appreciation to those who assist you by leaving Rep Point https://www.petri.com/forums/core/im.../icon_beer.gif

        Comment


        • #5
          Re: Exchange needs Reboot

          Yes. that is true. I assume Maybe AV is doing something during non-office hours but how do I know hat it is doing ?

          Comment


          • #6
            Re: Exchange needs Reboot

            Is there any sort of regularity in terms of when the exchange server dies, or is it random times ?

            You mentioned Trend Micro Worry Free Business edition or something like that, right ?
            It should have Scanmail for Exchange if i'm not mistaken, but I don't see the relevant services?

            At the very least, see if you can remove all the relevant exchange folders, databases and files from the On-access scanning, and any scheduled scans to start with

            Also make sure you have all relevant patches for both exchange and Trend Micro's product and keep an eye on it..
            Please do show your appreciation to those who assist you by leaving Rep Point https://www.petri.com/forums/core/im.../icon_beer.gif

            Comment


            • #7
              Re: Exchange needs Reboot

              it is regular. previously it was every 7th day after restart that exchange died. now it is every third day after a server restart.

              The list that I mentioned are the only services related to the antivirus software on exchange.

              I will stop the automatic scan and scheduled scan on exchange. will let you know for any update

              Comment


              • #8
                Re: Exchange needs Reboot

                regular in terms of time ?
                Please do show your appreciation to those who assist you by leaving Rep Point https://www.petri.com/forums/core/im.../icon_beer.gif

                Comment


                • #9
                  Re: Exchange needs Reboot

                  Basically I cannot find out the exact time when this is happening. I check if exchange is up and running every morning. so for me the the when exchange stops is somewhere after the mid-night of second day

                  Comment


                  • #10
                    Re: Exchange needs Reboot

                    does trend micro run regular scans ?
                    Please do show your appreciation to those who assist you by leaving Rep Point https://www.petri.com/forums/core/im.../icon_beer.gif

                    Comment


                    • #11
                      Re: Exchange needs Reboot

                      Primary suspect in this will be AV.

                      Due to the way that the AV integrates with Exchange, the only way to show if it is the AV is to remove it completely and reboot the machine. Stopping/disabling the services is not enough, because the hooks are still in the system.

                      I wouldn't be looking anywhere other than the AV at this time, until it is shown not to be the cause by its complete removal.

                      Simon.
                      --
                      Simon Butler
                      Exchange MVP

                      Blog: http://blog.sembee.co.uk/
                      More Exchange Content: http://exchange.sembee.info/
                      Exchange Resources List: http://exbpa.com/
                      In the UK? Hire me: http://www.sembee.co.uk/

                      Sembee is a registered trademark, used here with permission.

                      Comment


                      • #12
                        Re: Exchange needs Reboot

                        I am a little bit confused abt removing the AV as it may expose the server to vulnerabilities and viruses and it would a lot more difficult for me to explain it to my senior members.

                        Fyi: we dont use IMF as the av itself is looking after the spam filtering

                        Comment


                        • #13
                          Re: Exchange needs Reboot

                          I don't see what there is to be confused about.
                          The most common cause of problems with Exchange is third party software. Therefore to ensure that the third party software is not the cause (or show it is) it must be removed.

                          Therefore you have two choices.

                          1. Remove the software, reboot and see if the problem continues.
                          2. Live with your current issues.

                          This type of issue is almost impossible to diagnose without removing the third party software.
                          While I appreciate that it may well put you at risk, do you not have AV on the desktops? You should be running a defence in depth scenario, where the loss of a single point for scanning doesn't expose everything.

                          Simon.
                          --
                          Simon Butler
                          Exchange MVP

                          Blog: http://blog.sembee.co.uk/
                          More Exchange Content: http://exchange.sembee.info/
                          Exchange Resources List: http://exbpa.com/
                          In the UK? Hire me: http://www.sembee.co.uk/

                          Sembee is a registered trademark, used here with permission.

                          Comment


                          • #14
                            Re: Exchange needs Reboot

                            An update to the current scenario. this time around I did not stop any services on exchange this time. exchage is as usual. The AV was scheduled to scan exchange everyday at 10 pm so i change the AV schedule to weekly scan on saturdays instead of a daily scan. Exchange was supposed to stop on monday but it did not, neither tuesday. I will wait for a couple of days more without the AV scanning exchange server.

                            Comment


                            • #15
                              Re: Exchange needs Reboot

                              had an authenticated relay attack so did not get to check what part of antivirus was causing problem in the exchange. it got to be either an AV update part or scheduled scan. I disabled both for a week and had this attack.

                              any suggestions where else do i check.

                              Comment

                              Working...
                              X