EdgeTransport.exe - Constant High CPU utilisation

[Matthew ORiordan]

Hi

I am running an Edge Transport Server on a high spec 64 bit server (2GB RAM,
2Ghz Quadcore, RAID) and Exchange 2007 Hub, Mailbox, Client Access etc. on
another even higher spec server (4GB RAM etc.).

Whilst the Exchange 2007 server runs perfectly (low CPU utilisation), I am
noticing that on the Edge Transport Server the CPU sits at 25% consistently
(I suspect as a result of using 100% of one core). I am confused what may be
causing this. I am also running Forefront security on that server, and have
applied SP1 to this server & the exchange server.

You can see a screen shot at the link below of the 25% cpu utilisation
consistenly, wtih everything else looking OK.
http://portfolio.lemonpreview.com/debug/edge-transport-25.jpg

Our server crashed completely this morning (after spending 10 minutes
logging in, I saw that CPU was at 100% yet the task manager was reporting
that all processes were at 0!), so had to restart it. I am now concerned
that something may very well be wrong if it sits at 25% constantly.

I have also checked the mail queues, event logs etc. and there does not
appear to be that much activity (i.e. we have only set up a few test but
active mail boxes).

Your help & advice is appreciated.

Regards,

Matthew O'Riordan
Lemon Foundation
http://www.lemonfoundation.com/

[Mark Arnold [MVP]]

Since you have applied SP1 to the Exchange server this is obviously
the lab. Flatten the box and put it back to pre SP1 state. Leave
ForeFront off it for the time being and take it one step at a time. My
Edge does show a constant load on the box higher than I'd like to see
but it's not that high.

[Matthew ORiordan]

Thanks for your feedback, however, can you answer the following.

If I remove SP1 from this Edge Server, will it continue to operate correctly
with the Exchange 2007 server which has SP1, or do I have to roll back both?

Also, is there a way to disable Forefront rather than completely uninstall
it? This is all just time consuming to get everything to this point so
trying to reduce time installing & uninstalling if there is a quicker way.

--
Regards,

Matthew ORiordan
Lemon Foundation
http://www.lemonfoundation.com/

[Mark Arnold [MVP]]

On Wed, 26 Sep 2007 05:46:02 -0700, Matthew ORiordan
<Matthew...@discussions.microsoft.com> wrote:

>Thanks for your feedback, however, can you answer the following.
>
>If I remove SP1 from this Edge Server, will it continue to operate correctly
>with the Exchange 2007 server which has SP1, or do I have to roll back both?
>
>Also, is there a way to disable Forefront rather than completely uninstall
>it? This is all just time consuming to get everything to this point so
>trying to reduce time installing & uninstalling if there is a quicker way.

Since it's a lab I suggested you format the box and start again,
especially since it's just an Edge and isn't tied in horribly to AD.
All you have to do is to terminate the subscription and do another one
when you've installed the box again.
Windows 2003 SP2 and Exchange 2007 RTM. Make sure everything is
working fine with ForeFront and then back the box up before putting
the Exchange 2007 SP1 back on.

[Matthew ORiordan]

Hi

Whilst I appreciate that this may solve the problem, I don't really see why
I should need to do this. The OS was only set up this week, I installed
Exchange EdgeTransport in the standard way, applied the updates, installed
the service pack, installed Forefront which is part of the installation
process. I then set up the routing and have done close on nothing else to
the server. Surely if I go through that whole process again I will only end
up with the same situation?

I have just been adding monitoring to the edgeTransport server and have now
noticed the following though.
- When it starts up the process sits at close on 0%
- After some time (no exact pattern here) the process jumps to 25%, and then
later to 50%. I have stopped it at this point, so possibly it could continue
to 100% which may have previously happened.
- What seems like around the same time (struggling to match up exactly the
alerts with the jumps in CPU and the event logs) I am receiving a warning in
the Event logs.

Event Type: Warning
Event Source: MSExchange Extensibility
Event Category: MExRuntime
Event ID: 1050
Date: 9/26/2007
Time: 5:56:55 PM
User: N/A
Computer: MAILFILTER
Description:
The execution time of agent 'Attachment Filtering Agent' exceeded 300000
(milliseconds) while handling event 'OnEndOfData'. This is an unusual amount
of time for an agent to process a single event. However, Transport will
continue processing this message.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.

Does this maybe shed some light on what could be the problem?

Regards,

Matthew ORiordan
Lemon Foundation
http://www.lemonfoundation.com/

[Mark Arnold [MVP]]

Because, this is how it's going to work.
You're going to flatten the box.
You're going to start again with a clean OS and RTM Exchange
installation.
You're going to put the release ForeFront on the box with all release
grade fixes and updates.
Then you're going to see how you get on.
If everything is working fine you can secure the installation and put
the SP on.
If everything wasn't working fine we can then look at troubleshooting
the production RTM grade code.
If it all starts going Pete Tong when you put the SP on it means we
have a bug (or some other emotive word ) with the SP and it can be
reported to MS.

There's no point bounding in here with SP1 problems because SP1 isn't
released and the troubleshooting for it isn't in these forums.

Need to know whether you're having the problem on RTM before anything
else. It's just basic stuff.

[Matthew ORiordan]

Hi

I am able to do that, however can you confirm whether Edge Transport without
SP1 will be compatible with Exchange 2007 with SP1? Do I now need to roll
back SP1 on both the servers because this will be a right pain the ar*e! ;)

Thanks.

--
Regards,

Matthew ORiordan
Lemon Foundation
http://www.lemonfoundation.com/

[Matthew ORiordan]

Well, as reluctant as I was to do this, I have reformatted the OS, set up
Edge, applied the updates and NOT installed the service pack or Forefront.
So far so good, but I would still very much appreciate it if someone could
confirm if Edge without SP1 is compatible with Exchange with SP1. The
developers here are annoyed because of how much downtime has been caused
already by me be a little overzealous in applying service packs to the dev
environment, but if we can expect further issues as a result of the mixed
environments I should probably look at rolling back SP1 on the exchange
server out of their development time. Can you roll back SP1, and is it
necessary?

--
Regards,

Matthew ORiordan