Re: Information Store taking all available memory.

From: Wayne Overcash [MSFT] (wayneo_at_online.microsoft.com)
Date: 04/22/04


Date: Thu, 22 Apr 2004 10:53:53 -0400

Hi Todd,

There are cases where the virus software is scanning things it should not
(such as the logs, databases, M drive etc.) and can cause serious problems.
The aforementioned should be excluded in the virus software.
To see if AV is the issue, disabling ALL the AV services (and turning of
background scanning in the registry) then rebooting will usually give
positive results. Below are some articles to check out:

306105 XGEN: Microsoft's Position on Antivirus Solutions for Exchange 2000
http://support.microsoft.com/?id=306105

298924 XADM: Do Not Back Up or Scan Exchange 2000 Drive M
http://support.microsoft.com/?id=298924

304232 XADM: Information Store Uses 100 Percent of the CPU with Exchange
2000
http://support.microsoft.com/?id=304232

285667 XADM: Understanding Virus Scanning API 2.0 in Exchange 2000 Server
SP1
http://support.microsoft.com/?id=285667

322310 XADM: Information Store Process Uses 100 Percent of CPU Resources
After
http://support.microsoft.com/?id=322310

-- 
Wayne Overcash
Microsoft PSS
When responding to posts, please "Reply to Group" via your newsreader so
that others may learn and benefit from your issue.
This posting is provided "AS IS" with no warranties, and confers no rights.
Please do NOT reply to this alias.  This alias is for newsgroup purposes 
only.
"Todd Hayden" <thayden@robbinswatson.com.au> wrote in message 
news:0cb301c425d7$b06964f0$a501280a@phx.gbl...
> I'm having the same or similar symptoms, i.e. exchange
> system would slow down and stop and usually a bunch of
> services noted in the MS article 316612
> (http://support.microsoft.com/default.aspx?scid=kb;en-
> us;316612&Product=exch2k) would stop, thereby requiring
> the server to be rebooted.
>
> We have performed 2 online virus scans via Symantec and
> Computer Associates and both report our server as
> uninfected. Our server (win2k with SBS2000, Exchange 2000,
> SQL Server 2000 all with latest updates) used to last up
> to a week before requiring a reboot. That was 10 months
> ago. Now we must reboot the server everyday as it will
> only last just a little over 1 day. I have implemented a
> routine restart early every morning to workaround this BIG
> problem. I have also analysed the "virtual bytes" used by
> the "store" instance (i.e. \Process(store)\Virtual Bytes)
> a few times each under different circumstances, including
> monitoring a "silent night", meaning no major programs
> were running (including virus scanning and backups) and
> still the store instance consumes the virtual bytes.
>
> We never have more than 34 client machines (32 win2k, 1 Xp
> & 1 win98) logged on to the domain. We have recently
> performed a defrag of the exchange private info store.
>
> We think our latest symptom of this BIG problem is
> universal print failures i.e. sometimes the application
> (it can be any application) will inform you that it can't
> find the printer or that it's not installed (which is a
> load of B.S.), or will seem like it printed successfully
> but will not be print out at all. We have 2 Kyocera FS
> printers and 2 Kyocera KM photocopiers on the network all
> with latest drivers installed. These print failure
> messages used to happen infrequently (10 months ago) but
> now it happens frequently everyday and the workaround is
> to try, try again. Sometimes closing the application, then
> opening it again will bypass the problem.
>
> My entire log review with pictures to illustrate the BIG
> problem is available via email if you wish to review it
> out of interest.
>
> I've also noticed in Task Manager the Page Faults count
> for "WinMgmt.exe" is approx. 3 million by midday and our
> realtime antivirus scanner, "InoRT.exe" is approx. 6
> million by midday. Whether this has anything to do with
> the BIG problem I'm currently trying to figure out.
>
> P.S. Our AV protection is Computer Associates InoculateIT
> 6 (with relevant updates installed).
>
>
>
>
>
>>-----Original Message-----
>>I have a problem with a client's machine which has been
>>running fine for a year until the end of January when I
>>added Exchange 2k SP3 and the Post SP3 patches.  Since
>>then the Information Store process gradually consumes all
>>available memory until the server stops.
>>There are no error messages in the event log but it is so
>>slow it may take 10 minutes to open up the Services. The
>>server has been down as low as 4k of available memory. If
>>I stop the Information Store service and restart it, it
>>takes about 14MB, growing to about 50MB by the end of the
>>working day. By the following morning it is using 600MB+
>>out of the installed 1GB of RAM.  The machine is running
>>SBS 2000 with 25 CALs although there are currently only
> 15
>>users on the system. Under SBS it is a Domain Controller
>>and SQL Server is in use.  Last year we had a similar
>>problem with SQL Server taking all the memory but it has
>>been limited to 512MB and we have had no problems since -
>>until the end of January 2004.
>>The Anti-virus software was changed about the same time
>>from Symantec to AVG for Exchange 2k.  Grisoft (AVG
>>authors) have looked at the problem and think it is a
>>Microsoft problem.  Anyone got any ideas or do I just
>>throw memory at the problem?
>>
>>James
>>
>>.
>> 


Relevant Pages

  • Re: Anti-Virus on Terminal Server 2003 POP3 email
    ... be of no use to Outlook running on the Terminal Server. ... all the POP3 email virus scanners I've found won't work on ... What you need is an enterprise class virus scanner for the server that you run concurrently with the Outlook session and does POP3 e-mail scanning. ...
    (microsoft.public.windows.terminal_services)
  • Re: Virus Problems......
    ... access the server at this point. ... >your Exchange AV scanner to get rid of this if it's ... You need to scan/clean your Exchange databases, ... >virus is, using the Exchange portion of your AV software. ...
    (microsoft.public.backoffice.smallbiz2000)
  • Re: Security issue with MS Exchange and Windows 2003 Server
    ... > user's mailboxes which is infected by a virus / trojan ... Anything you move to the new server that COULD contain a virus (like ... Why are you not running Exchange aware SMTP based AV software? ... Setup a new server, install Symantec Corporate Edition 10.0 and properly ...
    (microsoft.public.security.virus)
  • Re: Tons of errors in SB 2000
    ... Since this is a server, not workstation, just fixing windows ... what's the point of having Windows ... Now, if you have Exchange sp3 installed, you can use the ... > virus was on a workstation and not the server. ...
    (microsoft.public.backoffice.smallbiz2000)
  • Re: Antivirus checking backup shadow copy
    ... > I run realtime scanning on the server and have for years. ... > send you a file that's a brand new virus. ... Yes, you're always running a risk of infection, and other problems, by the ...
    (microsoft.public.windows.server.sbs)