Hello,

I have moved the Send and Receive protocol log paths on all of my Exchange 2013 servers.

The new SmtpSend and SmtpReceive directories have been created, but the SmtpReceive directory is emtpy on each server.

From what I can tell the logs are still being collected in the ExchangeServer\V15\TransportRoles\Logs\FrontEnd\ProtocolLog\SmtpReceive directory.

Why is this?

Verbose logging is enabled on all of the "FrontendTransport" role receive connectors.

Thanks

Matt

I am trying to do an Exchange 2007 to 2013 migration.  Before doing all the final repointing of DNS and proxying clients, I just want to make sure that the new Exchange 2013 is healthy.  So I run a Get-HealthReport and it shows both the Online states of HubTransport and FrontendTransport as Unhealthy.

In the event logs under Microsoft>Exchange>ManagedAvailability>Monitoring I see Error events for them about the client submission probe failed x times over 15 minutes.  No connection because the target machine actively refused it 127.0.0.1:587. There was also another one that said Unable to relay.  For the Hub Transport it does not give as detailed information.  It just says The HubAvailibilityProbe has failed 5 or more times in 15 minutes.  Last failing server: ".

So it would sound like a connectivity problem, so with TELNET I tried to connect to port 25 and I get this:

telnet 127.0.0.1 25

421 4.3.2 Service not available

BUT if I put the hostname instead of 127.0.0.1, I get the 220 EMAIL.domain.com Microsoft ESMTP MAIL Service ready.

I tried temporarily disabling the windows firewall and its the same problem.  I know SMTP is running because from another machine I can telnet to the mail server on port 25 and I get the SMTP banner.

So for me it seems like the Managed Availability is trying to use the IP address of 127.0.0.1 and that fails fundamentally for me when I try that in the command line, so no wonder why its marking the FrontendTransport as unhealthy.  How can I resolve this?  I would think a resolution would be either somehow allow 127.0.0.1 access to relay which I DID put in my Frontend Transport receive connector, but it made no difference.  Or the other option is somehow  configure the probe to use the hostname instead of 127.0.0.1.  

As far as the HubTransport being unhealthy, I have a feeling its the same type of issue, but I am not seeing as detailed information in this path of the Event Viewer.

your links dont give an answer.

My outlook web app has been working fine and then all of a sudden wont allow me to attach files to a new email?

Good day!
We have a on-premise Exchange 2013 CU6 environment  with two multirole servers (CAS1 and CAS2).
After migrating from Exchange 2010 we noticed following issue:
User photos uploads from Sharepoint protal profile to AD thumbnailPhoto attribute and then they appear in Exchange 2013 GAL.

But if photo is removed from  Sharpoint profile (or thumbnailphoto attribute) changes did not reflects in Exchange GAL (OWA or Outlook Online mode).

Tried following:

Get-GlobalAddressList | Update-GlobalAddressList           - no effect

Get-OfflineAddressBook | Update-OfflineAddressBook       - no effect

I managed to remove photo from OWA and Outlook only after running Remove-UserPhoto -Identity username

Is this normal behavior or something needs to be fixed?

Thank you.

Is there a sensible way to search the SMTP Receive protocol logs on the client access servers?  The Get-MessageTrackingLog cmdlet only searches the mailbox servers, but I need to be able to look at what's connecting to the CAS sometimes and manipulate those logs.  The transport logs are entirely too verbose for some of my needs.

I've been parsing the logs via PowerShell using some form of these piped commands I've put together, and it's certainly functional, but I can't help but feel that I'm doing things the hard way.

Get-ChildItem -Path 'C:\Program Files\Microsoft\Exchange Server\V15\TransportRoles\Logs\FrontEnd\ProtocolLog\SmtpReceive\*' -Include '*.LOG' |
Where-Object -Filter {$_.LastWriteTime -gt (Get-Date).AddDays(-1)} |
Sort-Object -Property 'LastWriteTime' |
Get-Content |
Where-Object -Filter {$_ -like '*,530 5.7.1 Client was not authenticated,*'} |
ConvertFrom-Csv -Header 'date-time','connector-id','session-id','sequence-number','local-endpoint','remote-endpoint','event','data','context' |
ForEach-Object -Process {
    [void]($_.'local-endpoint' -match '(.*):([0-9]*)$')
    $lip = [IPAddress]$Matches[1]
    $lport = [Int]$Matches[2]
    [void]($_.'remote-endpoint' -match '(.*):([0-9]*)$')
    New-Object -TypeName PSObject -Property @{
        'date-time' = [datetime]$_.'date-time';
        'connector-id' = [string]$_.'connector-id';
        'session-id' = [string]$_.'session-id';
        'sequence-number' = [int]$_.'sequence-number';
        'local-endpoint' = [string]$_.'local-endpoint';
        'local-endpoint-ip' = $lip;
        'local-endpoint-port' = $lport;
        'remote-endpoint' = $_.[string]'remote-endpoint';
        'remote-endpoint-ip' = [IPAddress]$Matches[1];
        'remote-endpoint-port' = $rport = [Int]$Matches[2];
        'event' = [string]$_.'event';
        'data' = [string]$_.'data';
        'context' = [string]$_.'context'
    }
} |
Format-Table -Property 'date-time','remote-endpoint-ip','data'

Hi all,

Have now setup 2 rules on Our Exchange server.Both have same priority (also tried different priority) but only one is added.So question is,does Exchange only add 1 disclaimer at the time.Does Exchange only add one rule and ignore the rest if a rule already has been added?

thanks!

Please mark as helpful if you find my contribution useful or as an answer if it does answer your question. That will encourage me - and others - to take time out to help you. Thank you! Off2work

I found error on my Mailbox server and can't find any description for this error:

(Process w3wp.exe, PID 3728) Connection leak detected for key contoso.ua/Enterprise Administrators/Exch_administrator in Microsoft.Exchange.Configuration.Authorization.WSManBudgetManager class. Leaked Value 2.

Source:MSExchange RBAC

Event ID:74

Task Category:RBAC

Level: Error

Log Name: Application

Exch_administrator - this is my user account. Any suggestion what it is can be?

Hi Experts,

I have to delete emails from particular mailbox with specific conditions:

1) received by few specific email ids

2) between specific time stamp / period  ( ex: from august month to November month)

My environment is Exchange 2010

Hi,

I am moving Exchange 2010 mailboxes to Exchange 2013 SP1 in production. When I move 2010 mailbox Outlook, OWA works fine right after the move but ActiveSync (HTTPProxy log shows on CAS 2013 server that it is still re-directing it to Exchange 2010 CAS servers). Exchange 2013 CAS server ActiveSync takes hours before it starts to see that mailbox is moved to Exchange 2013. I am certain it is not ActiveDirectory replication since all other clients are working.

This time I move another user this time it did not work for 3.5hrs.  I had to reboot Exchange 2013 CAS server after that it worked.

There is must be something that is not refreshing on Exchange 2013 CAS server.  

Is there anything I can do right after the move to make it quick, I can not re-start server after every mailbox move.  Currently we are in Pilot mode and only moving few mailboxes at a time.

Thanks,

Raman

We have and IT liaison in each department and I'd like them to be able to edit their own departments mailboxes attributes.  ie. phone numbers, title...

I was hoping they would be able to do this in Outlook by opening up the Address Book selecting the user, and changing their new phone number, title ...

What do I need to do to allow them to manage this task for their department only?

EX2013 sp1/Win2012/OL2010-2013

PennyM

When using the following PowerShell command, what form does the "Property Value" parameter take:

Add-GlobalMonitoringOverride -Identity "HubTransport\Transport.ServerCertExpireSoon.Monitor" -ItemType Monitor -PropertyName SecondaryMonitoringThreshold -ApplyVersion "15.0.913.22" -PropertyValue ???

This monitor alerts 90 days out from expiry, and can't be configured in SCOM.  I want to try and set the "Monitoring Threshold" to 30 days and the "Secondary Monitoring Threshold" to 15 days.

In Exchange 2013 CU5, is it possible to express the "Property Value" in the following Powershell command as a "percentage" figure?

Add-GlobalMonitoringOverride -Identity "MailboxSpace\StorageLogicalDriveSpaceMonitor" -ItemType Monitor -PropertyName MonitoringThreshold-PropertyValue 20480 –ApplyVersion “15.0.913.22”

The problem is that this monitor doesn't distinguish between Logs and Databases, and waiting until a Database to gets down to 20Gb free seems a bit late.  Our Log volumes are only 40Gb in size - and that is all that is required.

I have a new 2013 sever Installed from a CU2 download, on a 2012r2 Virtual server. The system only has 25 users on it. The C and D drives are 1TB The SYSTEM Reserved partition is 350MB and I'm getting:

Log Name:      Application
Source:        MSExchangeDiagnostics
Date:          11/22/2013 12:52:30 PM
Event ID:      1006
Task Category: Triggers
Level:         Error
Keywords:      Classic
User:          N/A
Computer:      VSS2.VLS.some domain.com
Description:
The performance counter '\\VSS2\LogicalDisk(HarddiskVolume1)\Free Megabytes' sustained a value of '89.00', for the '15' minute(s) interval starting at '11/22/2013 6:37:00 PM'. Additional information: None. Trigger Name:DatabaseDriveSpaceTrigger. Instance:harddiskvolume1
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="MSExchangeDiagnostics" />
    <EventID Qualifiers="49156">1006</EventID>
    <Level>2</Level>
    <Task>2</Task>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2013-11-22T18:52:30.000000000Z" />
    <EventRecordID>77102</EventRecordID>
    <Channel>Application</Channel>
    <Computer>VSS2.VLS.some domain.com</Computer>
    <Security />
  </System>
  <EventData>
    <Data>\\VSS2\LogicalDisk(HarddiskVolume1)\Free Megabytes</Data>
    <Data>89.00</Data>
    <Data>15</Data>
    <Data>11/22/2013 6:37:00 PM</Data>
    <Data>None</Data>
    <Data>DatabaseDriveSpaceTrigger</Data>
    <Data>harddiskvolume1</Data>
  </EventData>
</Event>

and the mail stops at least once a day until I restart the Server or the Transport service.  I tried disabling the databasedrivespacetrigger Per the fallowing thread

http://social.technet.microsoft.com/Forums/exchange/en-US/1471af00-e987-4c5f-8601-609c157bee66/diskspace-events-exchange-2013-cu2v2-1006?forum=exchangesvradmin

The Volume its complaining about is the "System Reserved" volume created during the server install.

Does anybody Know how to turn this off or have any experience or comment about increasing the size of the System Reserved partition until this thing is Happy?

I am receiving the above message for internal Outlook 2013 users when they open Outlook. Despite this message, Outlook is fully functional. External OA users do not see this message. We are using an SRV record for our autodiscover and pointing it to the name on the single cert we have. I've also already changed the outlookprovider record in Exchange. Any ideas?

TIA!

Hello,

It is a server 2012 running Exchange 2013 fresh install for testing purposes. Exchange set up was done with no error. Emails are ok internally, using OWA or phone under the same network or out of it, no problem with send and receive. IIS properly set up and both OWA and ESP working internally and externally.

But cannot send emails to other domains, externally. Even though still receives emails from any external domains. Telnet is working properly, connections are ok, ports are properly taken care of (used to be 25, same thing, changed it to 587 in case ISP blocking 25 but no success).

Bounce back message:
-------------------------------------------
Diagnostic information for administrators:
Generating server: <servername>
Receiving server: yahoo.com <*****>
****@yahoo.com
10/8/2014 5:35:53 PM - Remote Server at yahoo.com (63.250.192.45) returned '550 4.4.7 QUEUE.Expired; message expired'
10/8/2014 5:24:18 PM - Remote Server at yahoo.com (63.250.192.45) returned '441 4.4.1 Error encountered while communicating with primary target IP address: "Failed to connect. Winsock error code: 10061, Win32 error code: 10061." Attempted failover to alternate host, but that did not succeed. Either there are no alternate hosts, or delivery failed to all alternate hosts. The last endpoint attempted was *****:587'

Dear Exchange Expert,

We are using Exchange 2010. Quite often, we need to do email tracking when user can't find their emails, etc. Some email might be already in the mailbox but might be moved to certain folder and the users might forget and just send the request to check that they didn't receive that specific email.

Usually I will check from the tracking log explorer and from there I will be able to know whether any issue with the email transport. My question is: is there anyway to check the status of the email that has been delivered? for instance: it has been read, moved to deleted items, inside junk folders, etc. Thus, we can straight away tell users that the email has been inside your mailbox or your junk mailbox, etc.

Thanks for your attention.

Regards,

Hendri

Hi Team logged below event errors can some one help me with quick resolution.

Log Name:      Application
Source:        MSExchange Control Panel
Date:          06-10-2014 09:54:10
Event ID:      4
Task Category: General
Level:         Error
Keywords:      Classic
User:          N/A
Computer:      PRO-HYD-MBOX01.ad.prolifics.com
Description:
Current user: 'ad.prolifics.com/Prolifics/SemanticSpace/Santosh Chowdary Vasireddy'
Request for URL 'https://pro-hyd-mbox01.ad.prolifics.com:444/ecp/default.aspx(https://mail.prolifics.com/ecp/)' failed with the following error:
System.Web.HttpException (0x80004005): Request timed out.

Log Name:      Application
Source:        MSExchangeIS
Date:          06-10-2014 10:02:41
Event ID:      1001
Task Category: General
Level:         Error
Keywords:      Classic
User:          N/A
Computer:      PRO-HYD-MBOX01.ad.prolifics.com
Description:
Microsoft Exchange Server Information Store has encountered an internal logic error. Internal error text is (Unable to apply maintenance update, index corruption?) with a call stack of (   at Microsoft.Exchange.Server.Storage.Common.ErrorHelper.AssertRetail(Boolean assertCondition, String message)
   at Microsoft.Exchange.Server.Storage.LazyIndexing.LogicalIndex.HandleIndexCorruptionInternal(Context context, Boolean allowFriendlyCrash, String maintenanceOperation, Nullable`1 messageDocumentId, Exception exception)
   at Microsoft.Exchange.Server.Storage.LazyIndexing.LogicalIndex.HandleIndexCorruption(Context context, Boolean allowFriendlyCrash, String maintenanceOperation, Nullable`1 messageDocumentId, Exception exception)
   at Microsoft.Exchange.Server.Storage.LazyIndexing.LogicalIndex.DoMaintenanceUpdate(Context context, Byte[] propertyBlob)
   at Microsoft.Exchange.Server.Storage.LazyIndexing.LogicalIndex.ApplyMaintenance(Context context, LogicalOperation operation, Byte[] propertyBlob)
   at Microsoft.Exchange.Server.Storage.LazyIndexing.LogicalIndex.SaveOrApplyMaintenanceRecord(Context context, MaintenanceRecordData maintenanceRecord, Boolean allowDeferredMaintenanceMode)
   at Microsoft.Exchange.Server.Storage.LazyIndexing.LogicalIndex.BuildUpdateRecords(Context context, IColumnValueBag updatedPropBag, Int64& firstUpdateRecord)
   at Microsoft.Exchange.Server.Storage.LazyIndexing.LogicalIndex.LogUpdate(Context context, IColumnValueBag updatedPropBag, LogicalOperation operation)
   at Microsoft.Exchange.Server.Storage.LazyIndexing.LogicalIndexCache.TrackIndexUpdate(Context context, Mailbox mailbox, ExchangeId folderId, LogicalIndexType indexType, LogicalOperation operation, IColumnValueBag updatedPropBag)
   at Microsoft.Exchange.Server.Storage.LogicalDataModel.Conversations.TrackConversationIndexUpdate(Context context, Mailbox mailbox, ConversationItem conversationItem, ConversationMembers conversationMembers, IEnumerable`1 folderIds, LogicalOperation logicalOperation)
   

Log Name:      Application
Source:        MSExchangeIS
Date:          06-10-2014 10:02:42
Event ID:      1002
Task Category: General
Level:         Error
Keywords:      Classic
User:          N/A
Computer:      PRO-HYD-MBOX01.ad.prolifics.com
Description:
Unhandled exception (Microsoft.Exchange.Diagnostics.ExAssertException: ASSERT: Unable to apply maintenance update, index corruption?
   at Microsoft.Exchange.Diagnostics.ExAssert.AssertInternal(String formatString, Object[] parameters)
   at Microsoft.Exchange.Server.Storage.Common.ErrorHelper.AssertRetail(Boolean assertCondition, String message)
   at Microsoft.Exchange.Server.Storage.LazyIndexing.LogicalIndex.HandleIndexCorruptionInternal(Context context, Boolean allowFriendlyCrash, String maintenanceOperation, Nullable`1 messageDocumentId, Exception exception)
   at Microsoft.Exchange.Server.Storage.LazyIndexing.LogicalIndex.HandleIndexCorruption(Context context, Boolean allowFriendlyCrash, String maintenanceOperation, Nullable`1 messageDocumentId, Exception exception)
   at Microsoft.Exchange.Server.Storage.LazyIndexing.LogicalIndex.DoMaintenanceUpdate(Context context, Byte[] propertyBlob)
  

Log Name:      Application
Source:        MSExchangeIS
Date:          06-10-2014 10:02:42
Event ID:      1013
Task Category: General
Level:         Error
Keywords:      Classic
User:          N/A
Computer:      PRO-HYD-MBOX01.ad.prolifics.com
Description:
The mailbox with mailboxguid "41299718-8e9c-480b-bfd1-a924634884c4" caused crash or resource outage on database (GUID="96142224-eacf-48ff-b82a-a1a3f73f3035")
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="MSExchangeIS" />
    <EventID Qualifiers="49156">1013</EventID>
    <Level>2</Level>
    <Task>1</Task>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2014-10-06T04:32:42.000000000Z" />
    <EventRecordID>7799949</EventRecordID>
    <Channel>Application</Channel>
    <Computer>PRO-HYD-MBOX01.ad.prolifics.com</Computer>
    <Security />
  </System>
  <EventData>
    <Data>41299718-8e9c-480b-bfd1-a924634884c4</Data>
    <Data>96142224-eacf-48ff-b82a-a1a3f73f3035</Data>
    <Binary>5B444941475F4354585D00007C000000FF4E00000000000000026000000080A1803024221496CFEAFF48B82AA1A3F73F3035302E3039808910103005000080A1803024221496CFEAFF48B82AA1A3F73F30351A010480808910103005000080A1803024221496CFEAFF48B82AA1A3F73F3035302E30398089101030050000</Binary>
  </EventData>
</Event>

Log Name:      Application
Source:        MSExchange Common
Date:          06-10-2014 10:02:42
Event ID:      4999
Task Category: General
Level:         Error
Keywords:      Classic
User:          N/A
Computer:      PRO-HYD-MBOX01.ad.prolifics.com
Description:
Watson report about to be sent for process id: 1328, with parameters: E12, c-RTL-AMD64, 15.00.0913.022, M.E.Store.Worker, M.E.S.Storage.LazyIndexing, M.E.S.S.L.LogicalIndex.HandleIndexCorruptionInternal, M.E.Diagnostics.ExAssertException, 423c, 15.00.0913.000.
ErrorReportingEnabled: False 

Log Name:      Application
Source:        MSExchange Common
Date:          06-10-2014 10:02:45
Event ID:      4999
Task Category: General
Level:         Error
Keywords:      Classic
User:          N/A
Computer:      PRO-HYD-MBOX01.ad.prolifics.com
Description:
Watson report about to be sent for process id: 13780, with parameters: E12, c-RTL-AMD64, 15.00.0913.022, w3wp#MSExchangeOWAAppPool, M.Exchange.StoreProvider, M.M.MapiProp.GetProps, M.E.D.Storage.ConnectionFailedTransientException-38144, 1f1-3ad8, 15.00.0913.000.
ErrorReportingEnabled: False 

Log Name:      Application
Source:        MSExchange Common
Date:          06-10-2014 10:02:45
Event ID:      4999
Task Category: General
Level:         Error
Keywords:      Classic
User:          N/A
Computer:      PRO-HYD-MBOX01.ad.prolifics.com
Description:
Watson report about to be sent for process id: 13780, with parameters: E12, c-RTL-AMD64, 15.00.0913.022, w3wp#MSExchangeOWAAppPool, M.Exchange.StoreProvider, M.M.ExRpcConnectionFactory.Create, M.E.D.Storage.MailboxOfflineException-25922, 5e6f-d3bd, 15.00.0913.000.
ErrorReportingEnabled: False 

Log Name:      Application
Source:        ExchangeStoreDB
Date:          06-10-2014 10:02:55
Event ID:      126
Task Category: Database recovery
Level:         Error
Keywords:      Classic
User:          N/A
Computer:      PRO-HYD-MBOX01.ad.prolifics.com
Description:
At '06-10-2014 10:02:44' the Exchange store database 'HYD-DB-01' copy on this server encountered an error that caused the database to be dismounted. For more detail about the failure, consult the Event log on the server for other "ExchangeStoreDb" or "msexchangerepl" events. A successful failover restored service.

Thanks & Regards, Santosh Chowdary Vasireddy System Administrator Prolifcs DHFLVC Silicon Towers, 5th Floor, Survey #14, Kondapur, Hyderabad – 500 032. Work +91 40 3999 1999 Ex.1656 l Cell +91 9849277255 l santosh.vasireddy@prolifics.com A Global Provider of IBM, Microsoft and Testing Solutions Award Winner for Technical Excellence, BPM, SOA, Portal and Governance

Hi

In night we have a problem with time sync on VMWare Host so our Exchange Environment stopped working. Edge server (Ex 2010 SP3 full update) stopped transfer e-mails to mailbox server (Ex 2010 SP3 full update). After time synchronization e-mails were treansfered to mailbox server. Users was able to send e-mail inside and outside but after 20-40 minutes users cannot send e-mails - between themselves and outside.

I don't see any e-mails in mailbox queues or using get-messagetrackinlog. I sent e-mail to our test e-mail mailbox on gmail and outlook.com. They wrere not be delivered by mailbox server. I can't find it using get-messagetrackinglog or in mailbox qeue.

What was happen? How to solve this problem?