Re: Windows 2003 SBS: Memory Leak?

Tech Tip: Click here to run a free scan for Windows Errors and optimize PC performance

From: Jeff Middleton [SBS-MVP] (jeff_at_cfisolutions.com)
Date: 08/16/04 

Date: Sun, 15 Aug 2004 20:51:42 -0500

I think that what we are looking at here is the difference between what you
should do and what you could do.

It's an absolute fact that you should not scan database files with an AV
file scanner that intends to find virus patterns in the database, if the
scanner isn't aware that it's needing to communicate with the database in
the process.

If in fact the downloads are pre-scanned, therefore the downloads are virus
free, it's not a good assumption that Exchange is going to run normally if
there is the external, unexplained, high-level service constantly trying to
lock the ENTIRE FILE in order to scan the last thing that changed.

This isn't a question of "is there a virus", or "is it going to find a
virus", it's a question of DDT. Don't Do That! Do not scan Exchange stores
with file level scanners. You can't diagnose the problem if you do that, and
if the symptoms go away when you stop doing that, you may well have your own
answer as a result.

It's your first step. Remove that issue, and see if the problem persists,
and we will keep looking at the symptoms and possible issues at that point.
:)

"Craig Luke" <craig-ms@kualo.com> wrote in message
news:%23$3v$EwgEHA.2856@TK2MSFTNGP10.phx.gbl...
> Hi Susan / Jeff,
>
> I have taken a look, and Norton AntiVirus was already set to exclude
various
> directories in c:\program files\exchsvr, but we keep the mailbox store on
a
> seperate drive, and that was being scanned. I have added it to the
exclusion
> list.
>
> With regard to anti-virus, we have an antivirus system on the server from
> which we download email, so we have not installed one onto the exchange
> server as yet. I've been trying to resolve this memory issue before making
> any other changes to the server.
>
> In light of the fact that NAV was already configured to exclude all but
the
> actual mail store, are there any other avenues you think I should persue?
>
> Best regards,
>
> Craig.
>
> "Susan Bradley, CPA aka Ebitz - SBS Rocks [MVP]" <sbradcpa@pacbell.net>
> wrote in message news:411FB433.6040101@pacbell.net...
> > Don't scan those Exchange stores and databases YOU WILL corrupt those
> > files. This could be the reason for that issue, yes. You need to have
> > a/v that is on that Exchange.
> >
> > Craig Luke wrote:
> >
> > > Hi Jeff,
> > >
> > > Thanks for the pointers...
> > >
> > > We use the POP3 connector in Exchange 2003 to download email every 15
> > > minutes, but I'd have thought that any problems with it would have
been
> > > found a long time ago.
> > >
> > > We don't have AntiVirus software for Exchange as yet (we scan
externally
> on
> > > the POP3 server), but we do have Norton AntiVirus Corporate Edition
> running
> > > on the server, and it is possible that it is scanning the Exchange
> queues,
> > > logs and databases. Would this have the same effect? I will look at
> adding
> > > in restrictions on the files/directories that it scans.
> > >
> > > Thanks again for your assistance, I really do appreciate it.
> > >
> > > Best regards,
> > >
> > > Craig.
> > >
> > > "Jeff Middleton [SBS-MVP]" <jeff@cfisolutions.com> wrote in message
> > > news:uK7fvwugEHA.3928@TK2MSFTNGP11.phx.gbl...
> > >
> > >>It's unlikely that it's a memory leak, unless you have either used an
> > >>Exchange plug-in/connector that is leaking, or if you are improperly
> > >>configured with your AV file/folder scanner to scan the Exchange
> resource
> > >>folders.
> > >>
> > >>Exchange Server AV specific software is required to work internally
with
> > >
> > > the
> > >
> > >>APIs of the Exchange, and your file space must NEVER scan the
databases,
> > >>logs, or related queues. Doing that would produce the issue you
> describe.
> > >>
> > >>As a standard operation, Store will increase in size to consume as
much
> > >>memory as is available and as serves to maintain less disk swapping
for
> > >>Exchange....as long as no other process is claiming unused memory.
> > >
> > > Exchange
> > >
> > >>releases the memory if it's requested.
> > >>
> > >>If you have a condition where Exchange doesn't release the memory,
it's
> > >>unlikely that it's Exchange that is holding the memory back, rather
it's
> a
> > >>conflicted operation that won't allow Exchange to release it.
> > >>
> > >>
> > >>
> > >>"Craig Luke" <craig-ms@kualo.com> wrote in message
> > >>news:631a01c482e1$fcacebe0$a301280a@phx.gbl...
> > >>
> > >>>Hello,
> > >>>
> > >>>This was posted to
> > >>>microsoft.public.windows.server.general, and I was
> > >>>pointed to this forum as you may be able to assist me
> > >>>further.
> > >>>
> > >>>I am hoping that someone may be able to provide some
> > >>>assistance with an issue I am seeing on a Windows 2003
> > >>>Small Business Server machine.
> > >>>
> > >>>The specifications are:
> > >>>
> > >>>P4 2.8GHz
> > >>>1Gb RAM
> > >>>x2 120Gb IDE HDDs (RAID 1)
> > >>>
> > >>>The server runs Microsoft Exchange, and while memory
> > >>>usage is normal, everything runs correctly.
> > >>>
> > >>>The problem is that on a Saturday night, it would appear
> > >>>that something on the server runs which increases the
> > >>>memory usage from an average of 800Mb used, to around
> > >>>2.5 - 3Gb used, but never decreases it. In task manager,
> > >>>the process using the most memory is store.exe, but it
> > >>>only uses around 300Mb, which I believe is normal, and it
> > >>>does not appear to increase.
> > >>>
> > >>>While the server continues to run, it is naturally
> > >>>swapping heavily, and it would appear that around
> > >>>Wednesday/Thursday, the memory usage increases again, and
> > >>>this is usually enough to kill the machine entirely. If
> > >>>it does survive through the week, it will never survive
> > >>>past the next Saturday night.
> > >>>
> > >>>Has anyone experienced this? My general suspicion/feeling
> > >>>would be that it is related to Exchange, but I have no
> > >>>proof at present.
> > >>>
> > >>>If you have any suggestions for debugging this, or have
> > >>>seen the problem before, I would be extremely grateful
> > >>>for any assistance you could provide.
> > >>>
> > >>>Thank you in advance...
> > >>>
> > >>>Best regards,
> > >>>
> > >>>Craig.
> > >>
> > >>
> > >
> > >
> >
> > --
> > http://www.sbslinks.com/really.htm
>
>

Quantcast