An issue came up this week that I feel is worth making Exchange Admins aware of. The symptoms of the problem is transaction logs growing uncontrollably on the Exchange Server (as high as 1000 logs per an hour). However there is no growth encountered in the EDB or STM files. Obviously this resulted in log file drives filling up and larger than expected backups.

The problem is with the Entourage client and its interaction with the Exchange Server. Entourage utilizes httpdav to interact with the Exchange server. When a user attempts to send a message larger than the maximum message size limits, the message gets stuck in the user’s Entourage Outbox because Entourage was unable to handle the error returned from the Exchange server regarding the message size. Since the user set the Send/Receive schedule set, the client would continuously attempt to submit the same message to the server. The server would accept, process, and reject the message, resulting in the increase in the number of transaction logs.

Immediate Steps to take in this situation:

• Disable www service on the server experiencing the problem, thus preventing Entourage clients from connecting.
• Determine the client(s) responsible by review message tracking logs, looking for messages with the same MessageID being submitted. These message will likely contain large attachments, therefore the message sizes would be large.
• Alternatively, if you are proficient with netmon, look a network sniff of incoming http traffic to the server and determine clients attempting to submit messages.
• You may also disable http protocol access for the client, also preventing the client further connections to the server.
• Remove messages from that clients Outbox.
• Adjust schedule on client so they are not continuously attempting to submit the message.
• Re-enabled www service, http protocol access, etc.

[Edit 01/04/05]: Adjusted immediate steps so they are clearer.