Exchange Server - Exchange 2007 typical CPU utilization (store.exe)

Asked By Luke

25-Jan-10 12:30 AM

Hi All,
we recently installed a monitoring package that via WMI queries and such
magic (NO agent software is installed), is able to monitor what is happening
across the network.

One thing I notice on our Exchange server is that the CPU always seems to be
busy. Closer inspection of the server (watching task manager) shows that
indeed store.exe is using around 15 - 50 percent of the CPU time almost
always.

Now this might be nomal, having only just got this product I am not sure
what the CPU utilization was like before.. but with my experience in Exchange
5.5 (and yes I know they are very different beasts) the CPU did not usually
get thrashed so much.

The event logs on the Exchange server do not have any errors and everything
seems to be OK in terms of response time, etc..

This is a small network of about 50 to 60 users, Exchange 2007 SP1 Rollup 8
on Windows 2003 Server x64 R2. We have LCR and SCR configured to run to
another server. The volume of mail being sent and received from this server
is very low.

The server itself only runs Exchange, Kaspersky Mail Security for Exchange,
and Kaspersky Antivirus (with exclusions for System/Exchange files). I have
watched the real time AV monitor to make sure nothing from Exchange is being
scanned and it all looks good.

I just wonder what a peoples store.exe CPU time looks like out there!

Cheers.

25-Jan-10 02:26 AM

LCR cannot run to another server.

You can turn off antivirus for a short while and see what your CPU numbers
look like.
--
Ed Crowley MVP
.

27-Jan-10 06:38 PM

I should have phrased my sentence better.. we are running LCR on the local
machine and SCR to another machine.

I have tried turning off the Antivirus, but it did not seem to make a
difference :S

I mean if you saw an Exchange 2007 server working normally, but hovering
around 40% CPU most of the time, and store.exe using that CPU.. would you be
concerned at all?

Cheers!

27-Jan-10 10:34 PM

What is your store maintenance schedule?
--
Ed Crowley MVP
.

28-Jan-10 12:55 AM

Each store has a 1 hour window with the first being 1am, the second store
2am, etc.. This is for all 7 days of the week.

This was setup by someone else though.. and although the stores are fairly
small (not more then a few GB each) I am wondering if this is enough time to
get all the work done.. I know exchange will pick up where it left off in the
next window, but that does not seem ideal to me.

28-Jan-10 10:21 AM

The it would make sense if you are running store maintenance all night long.

One-hour windows are generally not the best way to do this because you do not
allow enough time for maintenance to finish.  You should change it so that
it starts after your backups finish, stop just before the start of business,
and consider letting it run all weekend.  For example, Tue 0100-0500, Wed
0100-0500, Thu 0100-0500, Fri 0100-0500, Sat 0100-Mon 0500.
--
Ed Crowley MVP
.

29-Jan-10 12:02 AM

That sounds like a good plan.. I will give them all at least 4 - 5 hours per
night and all weekend as well.

I will set this on Monday (dont want to break anything on Friday arvo) and see
what happens.

By the by, checking the CPU usage today and noticed it has gone back to
pretty much idle all the time, with a big spike every couple of hours. I
dunno..

Thanks very much your your response!!

29-Jan-10 12:22 AM

If you schedule multiple stores' maintenance concurrently, you may be warned
about it in the event log.  If performance during that period is not a
problem, do not worry about the warning.
--
Ed Crowley MVP
.

07-Feb-10 05:20 PM

Hi Ed,
I seperated out the maintenence and backups so that there are no overlaps,
but after a day the CPU started behaving how it did previously.

The problem was Kaspersky 6.0 for Exchange 2007. It runs updates every 2
hours, but after an update it scans the whole store again :S.. Every 2 hours
the store was being scanned for 1 hour.. not ideal.

I have changed the updates to once a day, outside of the maintenence and
backup windows but before things get busy, and now the CPU teeters around 5%
all day, with a big spike during the update/scan around 7am.

I will see how this travels during the week, but I think that with CPU, Disk
and memory utilization all being down, it should help performance a lot.

I really was not expecting the AV software to fully scan the stores after an
update, so that was a bit of a shock.

Thanks once again for your assistance and pointing out the AV as a suspect!!

Kind Regards,

Luke

07-Feb-10 05:31 PM

Is there no option to scan just the messages that arrived, say, in the
last two days, and to do so at some time that is more convenient?


Updating AV signatures only once a day may not be the best thing to,
but scanning everything on every AV signature update probably is not
either.

Doesn't that AV software have an option to rescan messages when
they are accessed? Or to rescan the entire store, say, once a week (or
once a month)?

You might want to have a look at MS Forefront for Exchange. Right now
it uses Kaspersky5, but it can also scan each message with several
other AV engines. What one engine might miss, another may catch.
---
Rich Matheisen
MCSE+I, Exchange MVP

08-Feb-10 05:16 PM

Hi Rich,
I am asking around on the Kaspersky support forums now to find out if there
is a way to update without scanning, but the only settings I can find is to
specify only scan emails newer then X months.. which I dont like the idea of
either.

It is also not meant to scan messages that are already scanned on the
Transport level.. but who knows what it actually does.

This product is licensed with our desktop software, so to purchase a whole
new product with licensing would be a hard sell.

Anyway, this will have to do for now.

Cheers!