microsoft.public.exchange2000.admin - Help - being flooded by large returned email!!

Author

Help - being flooded by large returned email!!

Applebaum

2002-10-05, 8:39 pm

This is an interesting scenario...

One of our users sent out a mass email to thousands of recipients. This
email and its attachment were over 5MB. The automatic returns from ISPs not
accepting that large of an email quickly ate up space on our server, causing
various Exchange services to crash and bringing the server to critical space
consumption levels.

I disconnected from the internet and immediately started making more space
where I could. To deal with the Exchange logs, I backed up the information
store, which purged many sizable log files.

When I open this user's mailbox, there are hundreds of returned 5MB
messages. When I delete a dozen or so of them, the free space on the
server diminishes by hundreds of MB. This must mean that the transactions
of deleting these messages are being recorded in the logs. If I stop
deleting them, I can run another backup and purge the log files.

This is very slow going, and is one problem.

Another problem is that as soon as I reconnect to our ISP, the returned
emails start flooding in again, faster than I can delete them (you recall
that deleting them takes up lots more space on the server).

Does anyone know of a way out of this so my staff can get back online today,
unhampered by this one email box? Can I limit incoming emails to this
addressee to under 1MB? If I do this, what happens to all the 5MB returns
coming in, will they go to a 'Bad Email' or an administrative folder?

Any other tips are, as always, greatly appreciated.

Thanks,

Matthew

Kevin Weilbacher

2002-10-05, 8:39 pm

I'm no expert --- but it sure sounds like you may need to call your ISP and
work with them on their side to stop that email account. After that, you
should be looking for some rope to tie up the hands of the user that did it
in the first place.
-kw

"Applebaum" <thetwamNOSPAM@yahoo.com> wrote in message
news:#S4N0PQVCHA.2056@tkmsftngp09...
> This is an interesting scenario...
>
> One of our users sent out a mass email to thousands of recipients. This
> email and its attachment were over 5MB. The automatic returns from ISPs
not
> accepting that large of an email quickly ate up space on our server,
causing
> various Exchange services to crash and bringing the server to critical
space
> consumption levels.
>
> I disconnected from the internet and immediately started making more space
> where I could. To deal with the Exchange logs, I backed up the
information
> store, which purged many sizable log files.
>
> When I open this user's mailbox, there are hundreds of returned 5MB
> messages. When I delete a dozen or so of them, the free space on the
> server diminishes by hundreds of MB. This must mean that the transactions
> of deleting these messages are being recorded in the logs. If I stop
> deleting them, I can run another backup and purge the log files.
>
> This is very slow going, and is one problem.
>
> Another problem is that as soon as I reconnect to our ISP, the returned
> emails start flooding in again, faster than I can delete them (you recall
> that deleting them takes up lots more space on the server).
>
> Does anyone know of a way out of this so my staff can get back online
today,
> unhampered by this one email box? Can I limit incoming emails to this
> addressee to under 1MB? If I do this, what happens to all the 5MB returns
> coming in, will they go to a 'Bad Email' or an administrative folder?
>
> Any other tips are, as always, greatly appreciated.
>
> Thanks,
>
> Matthew
>
>

Applebaum

2002-10-05, 8:39 pm

Wouldn't the ISP's job be just to deliver anything with @OurDomainName.com
to our Exchange server? Would they be able to filter by a person's name?

Well, it's definitely worth a phone call, thanks!

Matthew

Kevin Weilbacher <kweilbac@gte.net> wrote in message
news:uq83BaQVCHA.1644@tkmsftngp08...
> I'm no expert --- but it sure sounds like you may need to call your ISP
and
> work with them on their side to stop that email account. After that, you
> should be looking for some rope to tie up the hands of the user that did
it
> in the first place.
> -kw
>
> "Applebaum" <thetwamNOSPAM@yahoo.com> wrote in message
> news:#S4N0PQVCHA.2056@tkmsftngp09...
> > This is an interesting scenario...
> >
> > One of our users sent out a mass email to thousands of recipients. This
> > email and its attachment were over 5MB. The automatic returns from ISPs
> not
> > accepting that large of an email quickly ate up space on our server,
> causing
> > various Exchange services to crash and bringing the server to critical
> space
> > consumption levels.
> >
> > I disconnected from the internet and immediately started making more
space

> > where I could. To deal with the Exchange logs, I backed up the
> information
> > store, which purged many sizable log files.
> >
> > When I open this user's mailbox, there are hundreds of returned 5MB
> > messages. When I delete a dozen or so of them, the free space on the
> > server diminishes by hundreds of MB. This must mean that the
transactions[color
=green]
> > of deleting these messages are being recorded in the logs. If I stop
> > deleting them, I can run another backup and purge the log files.
> >
> > This is very slow going, and is one problem.
> >
> > Another problem is that as soon as I reconnect to our ISP, the returned
> > emails start flooding in again, faster than I can delete them (you[/color]
recall
> > that deleting them takes up lots more space on the server).
> >
> > Does anyone know of a way out of this so my staff can get back online
> today,
> > unhampered by this one email box? Can I limit incoming emails to this
> > addressee to under 1MB? If I do this, what happens to all the 5MB
returns
> > coming in, will they go to a 'Bad Email' or an administrative folder?
> >
> > Any other tips are, as always, greatly appreciated.
> >
> > Thanks,
> >
> > Matthew
> >
> >
>
>

Jeff Middleton [SBS-MVP]

2002-10-05, 8:39 pm

You can deal with this in several ways, just depends upon what you want as
the impact of this.

+ Probably the simplest in this situation is to create a rule with Outlook
that sees the mailbox receiving the NDRs and have it permanently delete the
messages as they come in. You could make the rule also send a notice to keep
track of the returning messages if you are tracking that.
+ Set a block on your server for attachments larger than 4Mb, disable NDR
notifications to sender (to avoid tapping them once again)
+ Set your AV scanner to block or remove attachments with the name or
extension indicated, or quarantine them for inspection. (if you can be that
specific)
+ Create a Recipient Filter or a User Policy for the mailbox in question
that deletes the items or blocks them at the point the size is exceeded.

Be sure to politely suggest to the originator of this scheme that
mass-mailing attachments is a bone-headed thing to do. This is why people
create ftp servers and you send a link to the location, huh?

"Applebaum" <thetwamNOSPAM@yahoo.com> wrote in message
news:#Mc55iQVCHA.2328@tkmsftngp09...
> Wouldn't the ISP's job be just to deliver anything with @OurDomainName.com
> to our Exchange server? Would they be able to filter by a person's name?
>
> Well, it's definitely worth a phone call, thanks!
>
> Matthew
>
>
> Kevin Weilbacher <kweilbac@gte.net> wrote in message
> news:uq83BaQVCHA.1644@tkmsftngp08...
> > I'm no expert --- but it sure sounds like you may need to call your ISP
> and
> > work with them on their side to stop that email account. After that,
you
> > should be looking for some rope to tie up the hands of the user that did
> it
> > in the first place.
> > -kw
> >
> > "Applebaum" <thetwamNOSPAM@yahoo.com> wrote in message
> > news:#S4N0PQVCHA.2056@tkmsftngp09...
> > > This is an interesting scenario...
> > >
> > > One of our users sent out a mass email to thousands of recipients.
This[
color=darkred]
> > > email and its attachment were over 5MB. The automatic returns from[/color]
ISPs
> > not
> > > accepting that large of an email quickly ate up space on our server,
> > causing
> > > various Exchange services to crash and bringing the server to critical
> > space
> > > consumption levels.
> > >
> > > I disconnected from the internet and immediately started making more
> space
> > > where I could. To deal with the Exchange logs, I backed up the
> > information
> > > store, which purged many sizable log files.
> > >
> > > When I open this user's mailbox, there are hundreds of returned 5MB
> > > messages. When I delete a dozen or so of them, the free space on the
> > > server diminishes by hundreds of MB. This must mean that the
> transactions[colo
r=darkred]
> > > of deleting these messages are being recorded in the logs. If I stop
> > > deleting them, I can run another backup and purge the log files.
> > >
> > > This is very slow going, and is one problem.
> > >
> > > Another problem is that as soon as I reconnect to our ISP, the[/color]
returned
> > > emails start flooding in again, faster than I can delete them (you
> recall
> > > that deleting them takes up lots more space on the server).
> > >
> > > Does anyone know of a way out of this so my staff can get back online
> > today,
> > > unhampered by this one email box? Can I limit incoming emails to this
> > > addressee to under 1MB? If I do this, what happens to all the 5MB
> returns
> > > coming in, will they go to a 'Bad Email' or an administrative folder?
> > >
> > > Any other tips are, as always, greatly appreciated.
> > >
> > > Thanks,
> > >
> > > Matthew
> > >
> > >
> >
> >
>
>

Applebaum

2002-10-05, 8:39 pm

Wow, thanks Jeff, that's a creative assortment. I ended up doing two things
that seem to be working for now:

In Exchange System Manager -> Small Business SMTP Connector, I set the
connection time for messages over 3MB to "Never Run". And in Active
Directory, I set delivery restrictions of 3MB for this particular user.

However, now I'm uncertain - what's going to happen to these 3000+ incoming
messages that exceed the size restriction? Will they attempt to re-deliver
themselves every 4 hours? They don't seem to be accumulating on my server,
thankfully. Maybe they're filling up a landfill somewhere on Staten Island.

If I used a permanently delete rule in Outlook, the deletion of messages
would still be recorded in Exchange's tracking logs, so they would continue
to grow, right?

Oh, and what does NDR stand for?

Many thanks!!!

Matthew

Jeff Middleton [SBS-MVP] <jeff@cfisolutions.com> wrote in message
news:#OO1ITRVCHA.2016@tkmsftngp09...
> You can deal with this in several ways, just depends upon what you want as
> the impact of this.
>
> + Probably the simplest in this situation is to create a rule with Outlook
> that sees the mailbox receiving the NDRs and have it permanently delete
the
> messages as they come in. You could make the rule also send a notice to
keep
> track of the returning messages if you are tracking that.
> + Set a block on your server for attachments larger than 4Mb, disable NDR
> notifications to sender (to avoid tapping them once again)
> + Set your AV scanner to block or remove attachments with the name or
> extension indicated, or quarantine them for inspection. (if you can be
that
> specific)
> + Create a Recipient Filter or a User Policy for the mailbox in question
> that deletes the items or blocks them at the point the size is exceeded.
>
> Be sure to politely suggest to the originator of this scheme that
> mass-mailing attachments is a bone-headed thing to do. This is why people
> create ftp servers and you send a link to the location, huh?
>
> "Applebaum" <thetwamNOSPAM@yahoo.com> wrote in message
> news:#Mc55iQVCHA.2328@tkmsftngp09...
> > Wouldn't the ISP's job be just to deliver anything with
@OurDomainName.com
> > to our Exchange server? Would they be able to filter by a person's
name?
> >
> > Well, it's definitely worth a phone call, thanks!
> >
> > Matthew
> >
> >
> > Kevin Weilbacher <kweilbac@gte.net> wrote in message
> > news:uq83BaQVCHA.1644@tkmsftngp08...
> > > I'm no expert --- but it sure sounds like you may need to call your
ISP
> > and
> > > work with them on their side to stop that email account. After that,
> you
> > > should be looking for some rope to tie up the hands of the user that
did
> > it
> > > in the first place.
> > > -kw
> > >
> > > "Applebaum" <thetwamNOSPAM@yahoo.com> wrote in message
> > > news:#S4N0PQVCHA.2056@tkmsftngp09...
> > > > This is an interesting scenario...
> > > >
> > > > One of our users sent out a mass email to thousands of recipients.
> This
> > > > email and its attachment were over 5MB. The automatic returns from
> ISPs
> > > not
> > > > accepting that large of an email quickly ate up space on our server,
> > > causing
> > > > various Exchange services to crash and bringing the server to
critical
> > > space
> > > > consumption levels.
> > > >
> > > > I disconnected from the internet and immediately started making more
> > space
> > > > where I could. To deal with the Exchange logs, I backed up the
> > > information
> > > > store, which purged many sizable log files.
> > > >
> > > > When I open this user's mailbox, there are hundreds of returned 5MB
> > > > messages. When I delete a dozen or so of them, the free space on
the[c
olor=darkred]
> > > > server diminishes by hundreds of MB. This must mean that the
> > transactions
> > > > of deleting these messages are being recorded in the logs. If I[/color]
stop[
color=darkred]
> > > > deleting them, I can run another backup and purge the log files.
> > > >
> > > > This is very slow going, and is one problem.
> > > >
> > > > Another problem is that as soon as I reconnect to our ISP, the
> returned
> > > > emails start flooding in again, faster than I can delete them (you
> > recall
> > > > that deleting them takes up lots more space on the server).
> > > >
> > > > Does anyone know of a way out of this so my staff can get back[/color]
online
> > > today,
> > > > unhampered by this one email box? Can I limit incoming emails to
this[
color=darkred]
> > > > addressee to under 1MB? If I do this, what happens to all the 5MB
> > returns
> > > > coming in, will they go to a 'Bad Email' or an administrative[/color]
folder? [colo
r=darkred]
> > > >
> > > > Any other tips are, as always, greatly appreciated.
> > > >
> > > > Thanks,
> > > >
> > > > Matthew
> > > >
> > > >
> > >
> > >
> >
> >
>
>[/color]

Gizmo :-\)

2002-10-05, 8:39 pm

How about connecting to ISP via out look express and create rule to delete
from server offending emails...you better hurry cos ISP is gonna find this
if not already done so and does your agreement allow mass mailing?

"Applebaum" <mapplenospam@inchnospam.com> wrote in message
news:ureK33RVCHA.3764@tkmsftngp08...
> Wow, thanks Jeff, that's a creative assortment. I ended up doing two
things
> that seem to be working for now:
>
> In Exchange System Manager -> Small Business SMTP Connector, I set the
> connection time for messages over 3MB to "Never Run". And in Active
> Directory, I set delivery restrictions of 3MB for this particular user.
>
> However, now I'm uncertain - what's going to happen to these 3000+
incoming
> messages that exceed the size restriction? Will they attempt to
re-deliver
> themselves every 4 hours? They don't seem to be accumulating on my
server,
> thankfully. Maybe they're filling up a landfill somewhere on Staten
Island.
>
> If I used a permanently delete rule in Outlook, the deletion of messages
> would still be recorded in Exchange's tracking logs, so they would
continue
> to grow, right?
>
> Oh, and what does NDR stand for?
>
> Many thanks!!!
>
> Matthew
>
>
> Jeff Middleton [SBS-MVP] <jeff@cfisolutions.com> wrote in message
> news:#OO1ITRVCHA.2016@tkmsftngp09...
> > You can deal with this in several ways, just depends upon what you want
as
> > the impact of this.
> >
> > + Probably the simplest in this situation is to create a rule with
Outlook
> > that sees the mailbox receiving the NDRs and have it permanently delete
> the
> > messages as they come in. You could make the rule also send a notice to
> keep
> > track of the returning messages if you are tracking that.
> > + Set a block on your server for attachments larger than 4Mb, disable
NDR
> > notifications to sender (to avoid tapping them once again)
> > + Set your AV scanner to block or remove attachments with the name or
> > extension indicated, or quarantine them for inspection. (if you can be
> that
> > specific)
> > + Create a Recipient Filter or a User Policy for the mailbox in question
> > that deletes the items or blocks them at the point the size is exceeded.
> >
> > Be sure to politely suggest to the originator of this scheme that
> > mass-mailing attachments is a bone-headed thing to do. This is why
people
> > create ftp servers and you send a link to the location, huh?
> >
> > "Applebaum" <thetwamNOSPAM@yahoo.com> wrote in message
> > news:#Mc55iQVCHA.2328@tkmsftngp09...
> > > Wouldn't the ISP's job be just to deliver anything with
> @OurDomainName. com
> > > to our Exchange server? Would they be able to filter by a person's
> name?
> > >
> > > Well, it's definitely worth a phone call, thanks!
> > >
> > > Matthew
> > >
> > >
> > > Kevin Weilbacher <kweilbac@gte.net> wrote in message
> > > news:uq83BaQVCHA.1644@tkmsftngp08...
> > > > I'm no expert --- but it sure sounds like you may need to call your
> ISP
> > > and
> > > > work with them on their side to stop that email account. After
that,

> > you
> > > > should be looking for some rope to tie up the hands of the user that
> did
> > > it
> > > > in the first place.
> > > > -kw
> > > >
> > > > "Applebaum" <thetwamNOSPAM@yahoo.com> wrote in message
> > > > news:#S4N0PQVCHA.2056@tkmsftngp09...
> > > > > This is an interesting scenario...
> > > > >
> > > > > One of our users sent out a mass email to thousands of recipients.
> > This
> > > > > email and its attachment were over 5MB. The automatic returns
from
> > ISPs
> > > > not
> > > > > accepting that large of an email quickly ate up space on our
server,
> > > > causing
> > > > > various Exchange services to crash and bringing the server to
> critical
> > > > space
> > > > > consumption levels.
> > > > >
> > > > > I disconnected from the internet and immediately started making
more[
color=darkred]
> > > space
> > > > > where I could. To deal with the Exchange logs, I backed up the
> > > > information
> > > > > store, which purged many sizable log files.
> > > > >
> > > > > When I open this user's mailbox, there are hundreds of returned[/color]
5MB[c
olor=darkred]
> > > > > messages. When I delete a dozen or so of them, the free space on
> the
> > > > > server diminishes by hundreds of MB. This must mean that the
> > > transactions
> > > > > of deleting these messages are being recorded in the logs. If I
> stop
> > > > > deleting them, I can run another backup and purge the log files.
> > > > >
> > > > > This is very slow going, and is one problem.
> > > > >
> > > > > Another problem is that as soon as I reconnect to our ISP, the
> > returned
> > > > > emails start flooding in again, faster than I can delete them (you
> > > recall
> > > > > that deleting them takes up lots more space on the server).
> > > > >
> > > > > Does anyone know of a way out of this so my staff can get back
> online
> > > > today,
> > > > > unhampered by this one email box? Can I limit incoming emails to
> this
> > > > > addressee to under 1MB? If I do this, what happens to all the 5MB
> > > returns
> > > > > coming in, will they go to a 'Bad Email' or an administrative
> folder?
> > > > >
> > > > > Any other tips are, as always, greatly appreciated.
> > > > >
> > > > > Thanks,
> > > > >
> > > > > Matthew
> > > > >
> > > > >
> > > >
> > > >
> > >
> > >
> >
> >
>
>[/color]

Ron

2002-10-05, 8:39 pm

Are you not a victim of relayed spam ???
Check your settings in system manager
protocols/smtp .. access relay restrictions

Ron

"Applebaum" <thetwamNOSPAM@yahoo.com> wrote in message
news:#S4N0PQVCHA.2056@tkmsftngp09...
> This is an interesting scenario...
>
> One of our users sent out a mass email to thousands of recipients. This
> email and its attachment were over 5MB. The automatic returns from ISPs
not
> accepting that large of an email quickly ate up space on our server,
causing
> various Exchange services to crash and bringing the server to critical
space
> consumption levels.
>
> I disconnected from the internet and immediately started making more space
> where I could. To deal with the Exchange logs, I backed up the
information
> store, which purged many sizable log files.
>
> When I open this user's mailbox, there are hundreds of returned 5MB
> messages. When I delete a dozen or so of them, the free space on the
> server diminishes by hundreds of MB. This must mean that the transactions
> of deleting these messages are being recorded in the logs. If I stop
> deleting them, I can run another backup and purge the log files.
>
> This is very slow going, and is one problem.
>
> Another problem is that as soon as I reconnect to our ISP, the returned
> emails start flooding in again, faster than I can delete them (you recall
> that deleting them takes up lots more space on the server).
>
> Does anyone know of a way out of this so my staff can get back online
today,
> unhampered by this one email box? Can I limit incoming emails to this
> addressee to under 1MB? If I do this, what happens to all the 5MB returns
> coming in, will they go to a 'Bad Email' or an administrative folder?
>
> Any other tips are, as always, greatly appreciated.
>
> Thanks,
>
> Matthew
>
>

Jeff Middleton [SBS-MVP]

2002-10-05, 8:39 pm

NDR = Non-Delivery Report

I'm just a little confused about what the status is here because I don't
quite follow "where" you think these messages are based upon where could
they be.

If you are using your Exchange on a static web connection, you could (a)
have your server doing SMTP transfers directly to the remote server you are
sending to or you could (b) have your server using relay to your own ISP and
their server is responsible for the sending to the final destination. In
other words, either these emails are being queued at this instant (a) on
your server trying to go out (b) on your ISP's server trying to locate the
destination.

If you don't have a static connection, then your server could maybe still be
trying to send the email batch and have some still in the queue to go out.
Likewise, your ISP would be the one receiving and sending the emails (not
likely you send direct from your own server to the remote endpoint if you
don't have a static web connection).

Regardless, if you ISP is either primary or secondary MX for your domain,
you *owe* them a call to tell them to kill these emails before they kill you
instead!

If your ISP isn't involved at all, then either the outbound emails have gone
to a remote destination server or they are still on your server. If they are
on your server, you can kill the queue yourself and it won't go at all to
any more end destinations.

Now, if you accept the point that emails are either in the queue going out,
out, or coming back in, you can control killing the ones still here or
coming back. It's the ones that have gone to a destination server that are a
mystery now. In most instances, a 5Mb attachment would be killed without
being accepted. Most email administrator people consider that too large to
accept in general. That means that you would have already had an NDR from
them, or they simply dumped the emails. In the case of the NDR, it's not
typical for the NDR from a remote server to have the attachment returned
too. What happens is the NDR is actually coming to you from your server.
This is happening because your server is saying "I tried to send your email
with an attachment to remote host ACME, but it refused it. Here's the email
you sent with the attachment still attached." However, since this is your
own Exchange server, it knows you already have the attachment in your
Exchange, so it's not duplicating it, it's just referencing the attachment
it previously sent. This means that you shouldn't be accumulating
attachments 5G at a time, you should only be seeing the attachment
indicated, but there's a single instance only in the Exchange.

If you actually delivered the email to someone's server, it could be queued
at their ISP's server, but then when their own server attempts to accept the
relay, it refuses it. In this case, maybe the email is return with an NDR
from their ISP, and it would look like a new attachment to Exchange.

Obviously, if you still have an active queue attempting to send this thing
out to places it hasn't reached yet, you really want to delete that message,
or at least delete the attachment from Exchange. You can do this with
Exmerge.

"Applebaum" <mapplenospam@inchnospam.com> wrote in message
news:ureK33RVCHA.3764@tkmsftngp08...
> Wow, thanks Jeff, that's a creative assortment. I ended up doing two
things
> that seem to be working for now:
>
> In Exchange System Manager -> Small Business SMTP Connector, I set the
> connection time for messages over 3MB to "Never Run". And in Active
> Directory, I set delivery restrictions of 3MB for this particular user.
>
> However, now I'm uncertain - what's going to happen to these 3000+
incoming
> messages that exceed the size restriction? Will they attempt to
re-deliver
> themselves every 4 hours? They don't seem to be accumulating on my
server,
> thankfully. Maybe they're filling up a landfill somewhere on Staten
Island.
>
> If I used a permanently delete rule in Outlook, the deletion of messages
> would still be recorded in Exchange's tracking logs, so they would continu
e
> to grow, right?
>
> Oh, and what does NDR stand for?
>
> Many thanks!!!
>
> Matthew
>
>
> Jeff Middleton [SBS-MVP] <jeff@cfisolutions.com> wrote in message
> news:#OO1ITRVCHA.2016@tkmsftngp09...
> > You can deal with this in several ways, just depends upon what you want
as
> > the impact of this.
> >
> > + Probably the simplest in this situation is to create a rule with
Outlook
> > that sees the mailbox receiving the NDRs and have it permanently delete
> the
> > messages as they come in. You could make the rule also send a notice to
> keep
> > track of the returning messages if you are tracking that.
> > + Set a block on your server for attachments larger than 4Mb, disable
NDR
> > notifications to sender (to avoid tapping them once again)
> > + Set your AV scanner to block or remove attachments with the name or
> > extension indicated, or quarantine them for inspection. (if you can be
> that
> > specific)
> > + Create a Recipient Filter or a User Policy for the mailbox in question
> > that deletes the items or blocks them at the point the size is exceeded.
> >
> > Be sure to politely suggest to the originator of this scheme that
> > mass-mailing attachments is a bone-headed thing to do. This is why
people
> > create ftp servers and you send a link to the location, huh?
> >
> > "Applebaum" <thetwamNOSPAM@yahoo.com> wrote in message
> > news:#Mc55iQVCHA.2328@tkmsftngp09...
> > > Wouldn't the ISP's job be just to deliver anything with
> @OurDomainName. com
> > > to our Exchange server? Would they be able to filter by a person's
> name?
> > >
> > > Well, it's definitely worth a phone call, thanks!
> > >
> > > Matthew
> > >
> > >
> > > Kevin Weilbacher <kweilbac@gte.net> wrote in message
> > > news:uq83BaQVCHA.1644@tkmsftngp08...
> > > > I'm no expert --- but it sure sounds like you may need to call your
> ISP
> > > and
> > > > work with them on their side to stop that email account. After
that,

> > you
> > > > should be looking for some rope to tie up the hands of the user that
> did
> > > it
> > > > in the first place.
> > > > -kw
> > > >
> > > > "Applebaum" <thetwamNOSPAM@yahoo.com> wrote in message
> > > > news:#S4N0PQVCHA.2056@tkmsftngp09...
> > > > > This is an interesting scenario...
> > > > >
> > > > > One of our users sent out a mass email to thousands of recipients.
> > This
> > > > > email and its attachment were over 5MB. The automatic returns
from
> > ISPs
> > > > not
> > > > > accepting that large of an email quickly ate up space on our
server,
> > > > causing
> > > > > various Exchange services to crash and bringing the server to
> critical
> > > > space
> > > > > consumption levels.
> > > > >
> > > > > I disconnected from the internet and immediately started making
more[
color=darkred]
> > > space
> > > > > where I could. To deal with the Exchange logs, I backed up the
> > > > information
> > > > > store, which purged many sizable log files.
> > > > >
> > > > > When I open this user's mailbox, there are hundreds of returned[/color]
5MB[c
olor=darkred]
> > > > > messages. When I delete a dozen or so of them, the free space on
> the
> > > > > server diminishes by hundreds of MB. This must mean that the
> > > transactions
> > > > > of deleting these messages are being recorded in the logs. If I
> stop
> > > > > deleting them, I can run another backup and purge the log files.
> > > > >
> > > > > This is very slow going, and is one problem.
> > > > >
> > > > > Another problem is that as soon as I reconnect to our ISP, the
> > returned
> > > > > emails start flooding in again, faster than I can delete them (you
> > > recall
> > > > > that deleting them takes up lots more space on the server).
> > > > >
> > > > > Does anyone know of a way out of this so my staff can get back
> online
> > > > today,
> > > > > unhampered by this one email box? Can I limit incoming emails to
> this
> > > > > addressee to under 1MB? If I do this, what happens to all the 5MB
> > > returns
> > > > > coming in, will they go to a 'Bad Email' or an administrative
> folder?
> > > > >
> > > > > Any other tips are, as always, greatly appreciated.
> > > > >
> > > > > Thanks,
> > > > >
> > > > > Matthew
> > > > >
> > > > >
> > > >
> > > >
> > >
> > >
> >
> >
>
>[/color]

Ed Woodrick

2002-10-05, 8:39 pm

First, disconnect the server from the Internet.

Next make sure that no users are logging on.

Now change the transaction logging for the private database to circular.

Delete the messages in the bad mailbox

Create a rule to delete any additional messages

A couple of choices next....

either bring the server back up to Internet and let the flood clean out then
turn circular logging back off.

or set the deleted items retention time to 0, turn circular logging back on,
then reconnect to Internet, let the flood clean and then reset the deleted
item retention time.

After things are cleaned out and reset, look at the nightly event logs and
see how much whitespace that you have left. If it's over 30% or so of the
database, you can optionally run eseutil to compact the database, but only
after a good backup.

Chastise user who do this very sternly (as if you hadn't already!)

"Applebaum" <thetwamNOSPAM@yahoo.com> wrote in message
news:#S4N0PQVCHA.2056@tkmsftngp09...
> This is an interesting scenario...
>
> One of our users sent out a mass email to thousands of recipients. This
> email and its attachment were over 5MB. The automatic returns from ISPs
not
> accepting that large of an email quickly ate up space on our server,
causing
> various Exchange services to crash and bringing the server to critical
space
> consumption levels.
>
> I disconnected from the internet and immediately started making more space
> where I could. To deal with the Exchange logs, I backed up the
information
> store, which purged many sizable log files.
>
> When I open this user's mailbox, there are hundreds of returned 5MB
> messages. When I delete a dozen or so of them, the free space on the
> server diminishes by hundreds of MB. This must mean that the transactions
> of deleting these messages are being recorded in the logs. If I stop
> deleting them, I can run another backup and purge the log files.
>
> This is very slow going, and is one problem.
>
> Another problem is that as soon as I reconnect to our ISP, the returned
> emails start flooding in again, faster than I can delete them (you recall
> that deleting them takes up lots more space on the server).
>
> Does anyone know of a way out of this so my staff can get back online
today,
> unhampered by this one email box? Can I limit incoming emails to this
> addressee to under 1MB? If I do this, what happens to all the 5MB returns
> coming in, will they go to a 'Bad Email' or an administrative folder?
>
> Any other tips are, as always, greatly appreciated.
>
> Thanks,
>
> Matthew
>
>

David Sengupta [MVP]

2002-10-05, 8:39 pm

One additional suggestion. When you set up mailboxes I always recommend
using the "Prohibit Send and Receive" limit. For example, let's say Joe has
a mailbox limit of 200 MB. You could set the following:

Issue warning - 195 MB
Prohibit Send - 200 MB
Prohibit Send and Receive - 300 MB

That way you don't have an unprofessional Prohibit Receive kicking in too
early ... lots of room to accept new mail after the mailbox is 'full' ...
but if you end up in a mail loop or situation like yours, the MB will just
shut down instead of filling like yours did. I recommend doing this for all
mailboxes ... as long as you keep enough buffer between Prohibit Send size
and Prohibit Send and Receive size you shouldn't run into any problems.

--
David Sengupta M.T.S., B.Sc., MVP, MCSE, MCSE 2000, CCA Ottawa, Canada
Exchange Diagnostics: Quest Spotlight on Exchange
http://www.quest.com/spotlight_exchange
Exchange Management: http://www.microsoft.com/mom
Exchange FAQ - http://www.swinc.com/resource/exch_faq.htm

"Applebaum" <thetwamNOSPAM@yahoo.com> wrote in message
news:#S4N0PQVCHA.2056@tkmsftngp09...
> This is an interesting scenario...
>
> One of our users sent out a mass email to thousands of recipients. This
> email and its attachment were over 5MB. The automatic returns from ISPs
not
> accepting that large of an email quickly ate up space on our server,
causing
> various Exchange services to crash and bringing the server to critical
space
> consumption levels.
>
> I disconnected from the internet and immediately started making more space
> where I could. To deal with the Exchange logs, I backed up the
information
> store, which purged many sizable log files.
>
> When I open this user's mailbox, there are hundreds of returned 5MB
> messages. When I delete a dozen or so of them, the free space on the
> server diminishes by hundreds of MB. This must mean that the transactions
> of deleting these messages are being recorded in the logs. If I stop
> deleting them, I can run another backup and purge the log files.
>
> This is very slow going, and is one problem.
>
> Another problem is that as soon as I reconnect to our ISP, the returned
> emails start flooding in again, faster than I can delete them (you recall
> that deleting them takes up lots more space on the server).
>
> Does anyone know of a way out of this so my staff can get back online
today,
> unhampered by this one email box? Can I limit incoming emails to this
> addressee to under 1MB? If I do this, what happens to all the 5MB returns
> coming in, will they go to a 'Bad Email' or an administrative folder?
>
> Any other tips are, as always, greatly appreciated.
>
> Thanks,
>
> Matthew
>
>

Sponsored Links