Thursday, August 14, 2014

How To: SMTP Log Flush Interval. #MSExchange #iammec

I’m pretty sure that one of the signs of aging is the frequency of conversations that start off with “hey, remember when.” I had one of these moments yesterday and could not help but laugh. Several years ago, I had the opportunity to spend three weeks in Redmond attending the Microsoft Masters rotation. Each instructor provided amazing content that allowed me to take notes that are still extremely useful to this day. Ask anyone that has been through the rotation about the first three days of transport with Brian Reid. It is a great conversation starter!

One of the great troubleshooting tricks that I picked up during my time in Redmond was how to configure the SMTP log flush time. By default, Exchange 2010 SP1 would cache transport logging in memory for five minutes (or 1 MB log file). After five minutes, the transport logs would be flushed from cache to the SMTP send and receive logs. This process would become problematic if you were troubleshooting an issue with transport flow and needed to chase down specific messages in the logs and did not want to wait five minutes. Maybe there are TLS issues that you need to figure out in real time!

With Exchange 2010 SP1, the process to reduce the memory cache time to 15 seconds was to set the following two entries in the Edge.Transport.exe.config file (found in \Program Files\Microsoft\Exchange Server\v14\bin) within the AppSettings area:

<add key="SmtpSendLogFlushInterval" value="0:00:15" />
<add key="SmtpRecvLogFlushInterval" value="0:00:15" />

Recently my fellow Geeks with a Blog buddy and I were discussing the process of flushing SMTP logs. This discussion highlighted the fact that the process to flush SMTP logs is a little bit different with Exchange 2013 due to the transport architecture changes. After a quick search, I found that Exchange MVP (and Transport instructor for the MCSM rotations) Brian Reid had a blog post on how to change the memory cache time on Exchange 2013 servers.

Within Exchange 2013, there are specific transport services present for the CAS role and transport services specific to the Mailbox role. To reduce the memory cache time to 15 seconds on a specific Exchange 2013 server, we have to make changes within four files. These files are found in the \Program Files\Microsoft\Exchange Server\v15\bin folder.

The following keys will need to be added in each file under the <appSettings> section of the file:

<add key="SmtpSendLogFlushInterval" value="0:00:15" />
<add key="SmtpRecvLogFlushInterval" value="0:00:15" />





In order for Exchange 2013 to recognize these changes the transport services will need to be restarted.

CAS Server:
Microsoft Exchange Frontend Transport

Mailbox Server:
Microsoft Exchange Transport
Microsoft Exchange Mailbox Transport Delivery
Microsoft Exchange Mailbox Transport Submission

Hopefully this tip will help in speeding up the troubleshooting process when looking at transport logs. After all, you never know when you might be troubleshooting certificate mismatches at 2 am!

No comments:

Post a Comment