cancel
Showing results for 
Search instead for 
Did you mean: 

Journal inbox slow to process mails

PeterJByrne
Level 2

My issue:

The journal inbox is not processing emails fast enough.

My setup

Running Enterprise Vault 9.0.2 on Windows server 2003
Running Exchange 2010 SP3 Rollup 7 on Server 2008R2
1 journal mailbox
3500 user mailboxes

My problem

The journal inbox contains about 20000 emails at 8am in the monring.  During the day this number rises to 75000 and then overnight it may drop down to 18000-20000 - then it all happens again (on a daily basis).

This has only started to happen in the last 3 weeks.

Things that I have noticed and tried to adjust

We have migrated a lot of users to Office 2013.
I can see in the logs that it is trying to expand distribution lists in our global environment, no local ones - Event ID 3257.
We have archiving set to run from 6pm to 6am every night.
I have changed the "Closest GC" and "DS Server" registry entries to "1" and "local GC" respectively

In a DTRACE I can see:

CEVFilterController::ProcessAllFilters - Time Taken to Process External Filter [EnterpriseVault.CustomFilter]: [1.053366] seconds

CArchivingAgent::ProcessItemInternal Time Taken to Process Item - 6***********************************: 2.070091 secs

CArchivingAgent::ProcessItemInternal Time Taken to Process Item - 6*************FA1: 2.070091 secs

CArchivingAgent::ProcessItemInternal Time Taken to Process Item - 6*************851: 2.596645 secs

CArchivingAgent::ProcessItemInternal Time Taken to Process Item - 6*************7D1: 5.925694 secs

CEVFilterController::ProcessAllFilters - Time Taken to Process External Filter [EnterpriseVault.CustomFilter]: [1.853000] seconds

CEVFilterController::ProcessAllFilters - Time Taken to Process External Filter [EnterpriseVault.CustomFilter]: [1.853000] seconds

CEVFilterController::ProcessAllFilters - Time Taken to Process External Filter [EnterpriseVault.CustomFilter]: [1.211429] seconds

CEVFilterController::ProcessAllFilters - Time Taken to Process External Filter [EnterpriseVault.CustomFilter]: [6.255991] seconds

Any ideas on how I can fix my systems

1 ACCEPTED SOLUTION

Accepted Solutions

PeterJByrne
Level 2

By adjusting the "Number of Concurrent connections" to the same number as processors on the EV server and dropping the "Maximum number of items per target per pass" from 1000 to 500 seems to have cleared the issue.

View solution in original post

6 REPLIES 6

PeterJByrne
Level 2

Just found this in the Dtrace also:

27945    11:26:32.298     [6280]    (JournalTask)    <11272>    EV:H    CArchivingAgent::ProcessItemInternal Time Taken to Process Item - 6080A303C63D52102A850004EBE856C1: 3130.435791 secs

 

GertjanA
Moderator
Moderator
Partner    VIP    Accredited Certified

Hello Peter,

That is strange. I have managed environments where they had Journal Mailboxes receiving over 200.000 mails a day and the mailboxes were empty in the morning..

To work on this issue, I would do the following:

Create a new Journal Mailbox, preferably on a seperate Exchange Server, if not possible, on a specific database having only the Journal Mailbox. Make this on a different Exchange-server than where the current mailbox sits on. Create a new Journal Archive, and Journal Task. change your journaling to use that new Journal Mailbox. Make sure the EVSystemmailbox for that task is on that server.

Change the Journal Policy to NOT expand distributionlists. For Exchange 2010 this is no longer necessary afaik.

For the old task, is the EVSystemmailbox on the same server as the journal mailbox? Do you have any events in the eventlog for EV indicating possible issues (with storage, or perhaps dcom, indexing etc)

When the new Journal Mailbox is in use, and the task is running, open the old Journal Mailbox in Outlook.

Examine the content. Look at mail-sizes. There might be a huge mail blocking processing. Do you have many 'pending archiving' items? Do you have mails that stand out because they look 'weird'?

If you have may pending items, you might need to check your policy, set the 'Pending shortcut Time Out' to 0, run the task in report mode. When all pending items are normal items again, drag the oldest few items from the mailbox, to the desktop, make sure they are removed from the mailbox, restart the task in normal mode. See what happens.

During the same, monitor the new Journal Mailbox to see if that does archive at the expected speed.

If this all fails, I suggest contacting Support, who should be able to assist further.

Good luck!

GJ

Regards. Gertjan

PeterJByrne
Level 2

Thanks for the prompt reply

I will work through your suggestions adn keep you posted

Peter

Andrew_G_
Level 5
Employee Accredited

Are your external filters based on large DLs?

If so you may have a compelling reason to upgrade. From the 10.0.3 release notes:

Exchange journal archiving was slow when external filters were enabled [Ref 16650, E2807834, R15574, E2767750]

Archiving performance was sometimes slow when external filters were enabled for the Exchange Journaling task. This issue could occur if several custom filter rules were based on large distribution lists.

This has been fixed.

PeterJByrne
Level 2

By adjusting the "Number of Concurrent connections" to the same number as processors on the EV server and dropping the "Maximum number of items per target per pass" from 1000 to 500 seems to have cleared the issue.

GertjanA
Moderator
Moderator
Partner    VIP    Accredited Certified

Good find. Thanks of letting us know.

Regards. Gertjan