virtual (VMware ESX) server Windows2008R2 Etn SP1 64bit
about 10 days ago we investigated the problem with our corporate e-mail.
the delay of incoming and outgoing e-mails (into the company) became extremly high.
the reason was the high CPU usage by RPCserv.exe (more then 25%).
After restart th McAfee MSME service everything works fine.
But after some time the problem was repeated.
We reinstalled the MSME 5 days ago, but today we face of this problem again.
Everything I have found is associated with GSE 7.0 and Exchange 2003, but not with MSME7.6.
anybody have the similar problem?
What is exact version of Exchange??
What Roles is the server fulfilling?? (HUB\MB\Edge)
Is Patch 1 installed for MSME?
If server is running Mailbox role do you have Background Scanning enabled??
Exchange Server 2010
Role is MailBox only.
Patch 1 is installed:
|Product Name||McAfee Security for Microsoft Exchange|
|Buffer Overflow Protection||Not Applicable|
Thera are no error events in Windows application and system logs associated with RPCserv.exe (or MSME).
Afte firs time we have disabled BGS by ePO policy (see attach).
So this detail is from configuration of Mailbox server(s) which suggests you will have Hub server(s) (and maybe edge server(s))??
Was the issue witnessed on the Mailbox server(s)?? Did an OnDemandScan of Mailboxes run into normal business hours or is there anything common to when this issue happens??
Or was the issue actually on the HUB or Edge servers??? Any evidence there of issue??
we have 5 virtual servers with next roles:
2 servers (DAG) are Mailbox role only;
2 servers are Hub role only;
1 servers is Edge role only.
As you can see on my previos post the BGS is disabled in epo policy.
Also there are no VSE installed on servers.
On the first time we faced the problem the issues were on MB, Hub and Edge servers. All of them had high CPU usage by rpcserv.exe.
We updated MSME to the lasted DAT and restart all servers. After that it has looked ok.
But after some days we faced the same issue on Mailbox server only. We have restarted msme service and total CPU load became less than 5%.
Now we enable the CPU counts on MB servers and especially on two process RPCserv.exe. If the problem repeats we'll have the evidences.
We suggest, that the reason was in bad DAT update.