Exchange 2003 with SMTP dying every few seconds

Question

I've Exchange 2003 which now all of the sudden have SMTP service dying every few seconds after restart of service. It started yesterday but after couple of hours i was able to stop this madness (to be honest not sure how) but multiple restarts, trying to hold some emails etc and it allowed me to finally start SMTP permamently. Today the problem is up and running again... Exchange is at latest service pack so the issues related to my earlier readings about this problem seem to be not related? I tried to reinstall service pack but it was complaining about earlier IMF being installed yet in directory of Exchange there's no IMFv1 but only IMFv2 so I would presume it's the newest version.

Does anyone have a clue how to solve this? Not really sure where to look for an answer?

• The Simple Mail Transfer Protocol (SMTP) service terminated unexpectedly. It has done this 97 time(s). Event ID 7034

• The IIS Admin Service service terminated unexpectedly. It has done this 57 time(s). The following corrective action will be taken in 1 milliseconds: Run the configured recovery program. Event ID 7031

• Virtual Server 2: SMTP server cannot read metabase key MailQueueDir. from SMTPSVC with EVENT ID 418

• Virtual Server 2: SMTP server cannot read metabase key MailPickupDir with EVENT ID 418

• Application pool 'DefaultAppPool' is being automatically disabled due to a series of failures in the process(es) serving that application pool. event id 1002

• Inetinfo terminated unexpectedly and the system was not configured to restart IIS Admin. The World Wide Web Publishing Service has shut down. event id 1030

• The application-specific permission settings do not grant Local Launch permission for the COM Server application with CLSID {A9E69610-B80D-11D0-B9B9-00A0C922E750} to the user NT AUTHORITY\NETWORK SERVICE SID (S-1-5-20). This security permission can be modified using the Component Services administrative tool. EVENT ID 10016

Seems like everything is failing ...

After I deleted this mail from queue folder smtp service got up and is now running... why would it cause such a mess.. now that I think of it yesterday I have also found russian email causing havoc and after deleting it problem was gone. Weird stuff...

Maybe bug?

Edit: I keep on getting more and more russian emails which crash smtp service daily...

Answer 1

I've worked with both Microsoft and Policy Patrol. Microsoft offered 2 patches (that didn't help) and also suggested after some diagnosis and similar cases in their database that Policy Patrol might be the case. Indeed Policy Patrol was interested in this and provide few versions on new smtp sinks. We're still working things thru as there are some errors still rarely but it's going good direction.

I was told to disable the following functionality and to replace it with new sink that they sent me:

• Bayesian filtering (including Automatic Bayesian filter learning)

• Address verification (Verify existence of MX record & Verify sender's SMTP connection)

So far I've had one crash today and there was one day when i had 100 per day. It's weird that something like this worked for so long without any problems and now out of the sudden started crashing (without me touching Policy Patrol or Exchange).

In case anyone have similar problems I would contact Policy Patrol first without engaging Microsoft as it really seems that it was Policy Patrol problem all the way.

Answer 2

I wanted to relay that we are having the exact same issues. It appears to happen to us once every day or two. If I grab the piece of russian spam from C:\Program Files\Exchsrvr\Mailroot\vsi 1 then do a iisreset then things are fine again until another offending message. We are running Exchange 2003 standard on Windows Server 2003 Enterprise -- and the common link . . . Policy Patrol.

We administer dozens of Exchange servers for dozens of companies and have never seen this issue before (and appears to be fairly rare). Interestingly enough, this is the only server that we run Policy Patrol on. I think you hit the nail on the head. Thanks for at least helping point us in the right direction.

Please post back anything you find out and we'll do the same!