Outlook is retrieving data from the Microsoft Exchange Server Server_Name; Christmas Balloon is not welcome for many Exchange administrators. We normally hate to see this message from client's outlook. I have seen this error so many times and decided to put some of the good trouble shooting notes together. Understanding the Mechanic being how Outlook application talk to the Exchange server is always plus. So Microsoft has a great explanation below, I am posting it as it is
This error may occur in different environments for different reason, most of the reasons are listed in here, you need to be patient for going through the trouble shooting process and document what you have doing.
I have seen a failed Exchange server Public folder replication, referrals was bringing 5000 people down. As soon as I disable the referrals thing went back to normal
I have also seen this problem on VPN remote user type of clients. In this type of chases user connect to a network from remote office and opens outlook within the VPN tunnel. The low bandwidth and both way encryption makes the Christmas balloon to show up all the times. Connect to a client and figured out the exchange server the client is connection too. Issue ping request back to the Exchange server anything over >50ms in ping request indicates Latency in the network Upgrading firmware might have helped the client experience on the local router. Checking MTU size or adjusting it time to time helps the Christmas balloon also increase the size of the ICMP packets by using below command
Ping exc03 -l 1000 -t
Asking client to call ISP and get more bandwidth is always a good thing if you can. Remember the Bottle neck can be Exchange related or the Global catalog server, as it is explained below. I have included the basic counters below, go ahead and kick these off from perfmon (performance monitor)
Click Start Perfmon and hit enter; I am including here my Vista nice looking one to make you all jealous
Hold "CTRL" Key and click on the outlook Icon right lower corner to get the Connection Status to see where the outlook is connecting
Mechanics
In Outlook 2002 and Outlook 2003, when Outlook requests data from a Microsoft Exchange computer, Outlook calls a function that wraps the remote procedure call to the Exchange computer. This wrapper is the CancelableRPC wrapper. By default, this wrapper starts a timer and then issues the remote procedure call. The timer stops when a response is received. However, if the remote procedure call for data takes more than five seconds to return the data, the wrapper produces the "retrieving data" message. The dialog box that contains the message remains on the screen until the remote procedure call is answered or until the user clicks Cancel. If the action that the user performs in Outlook creates multiple remote procedure calls, the message could appear one time for each remote procedure call.
You receive this message as part of the standard interoperation of Outlook and Exchange. Even on the fastest network that has the best hardware and architecture, some remote procedure calls will take more than five seconds to obtain a response. This is a simple fact, and the appropriate expectations should be set with users. If the message appears only occasionally, no extensive troubleshooting is required. Trying to troubleshoot when the message appears only occasionally is not likely to be productive.
Remote procedure call is a sequential transport. When a remote procedure call is made, it must be answered, or the remote procedure call session must be restarted. This is different from a protocol like the Internet Protocol (IP) where packets can be received in any order and then reconstructed on the other side. This understanding is fundamental when you try to troubleshoot problems that are related to remote procedure calls that can be canceled from the dialog box or the balloon that contains the "receiving data" message.
If client-side troubleshooting and data gathering is required, the support engineer has to know the actions that users are performing when the "retrieving data" message is frequently displayed. For example, the following information is important:
Is the user browsing a public folder that is homed in another administrative group? Does the public folder not exist as a replica in the user's own site?
Is the user opening a meeting that has many attendees?
Is the user creating or updating a meeting and checking the free-busy status of the attendees?
Finally, analyze the Active Directory, directory service architecture and the Exchange architecture in the environment. Be prepared to provide us with the answers to the following questions: • Are the global catalogs located on a local computer or on a remote computer?
Does the connectivity to the remote site involve passing through routers and firewalls?
Are there dedicated public folder servers?
Where are the system public folders homed?
Note any add-ins or Component Object Model (COM) add-ins that Outlook uses. To find these items, follow these steps In Outlook, click Tools, click Options, click other, and then click Advanced Options. In this window, click Add-in Manager and COM Add-ins. Note the contents of both windows. The following are the default items that are included with Exchange profiles:
Delegate Access
Deleted Item Recovery
Exchange Extensions Commands
Exchange Extensions property pages
Server Scripting (Typically, this item is not selected
In Outlook 2002, a feature is added notifies users that the connection to the Microsoft Exchange computer is taking longer than expected because of network congestion or server availability. This connection can include connections to the user's mailbox, a free and busy server, or any other server that Outlook may need to communicate with to fulfill a request for information. When such a delay occurs, the following Cancel Request dialog box is displayed:
Outlook is retrieving data from the Microsoft Exchange Server Server_Name. You can cancel the request or minimize this message to the Windows taskbar until Outlook closes the message automatically.
The types of data that Outlook retrieves during this period include information in the user's mailbox, information in the user's public folders, free/busy information, and directory look-ups (check-name).
The server that Outlook queries for this information is either a
If the server name appears as a NetBIOS name, the data is being retrieved from an Exchange Server computer. If the server name appears as a fully qualified domain name (FQDN), the data is being retrieved from a global catalog server.
How to turn off third-party add-ins in Outlook If your profile contains any third-party add-ins, such as antivirus software, BlackBerry software, or fax software, follow these steps:
On the Tools menu in Outlook, click Options.
Click the Other tab, and then click the Advanced Options button.
Click the Add-In Manager button.
Click to clear the check box for any third-party add-ins that may be selected.
Click OK three times.
Restart Outlook
Troubleshoot performance issues
To troubleshoot performance issues, gather data by using Performance Monitor. It is common to experience RPC latency when either an Exchange Server computer or a global catalog server is experiencing performance issues.
If the RPC dialog references an Exchange Server (NetBIOS name), configure Performance Monitor to monitor the following counters in real time:
Physical Disk (All Instances)
MSExchangeIS
RPC Averaged Latency
RPC Requests
RPC Operations/Sec
Processor
Database (Information Store Instance)
Note It is a good idea to run Performance Monitor from a remote workstation that has lots of free disk space.
Typically, it is a good idea for the RPC Requests counter to be lower than 10. If it is higher than 25, this is an indicator of a resource bottleneck. Only 100 requests can be handled at the same time. If the RPC Requests reach 100, the client will experience refused connections.
The RPC Averaged Latency counter displays the average time that it takes the server to respond to client requests. The value of the counter is typically less than 50 milliseconds in typical operations. If the value is consistently more than 50 milliseconds with Outlook 2002 or Outlook 2003 when most of the users are in Online Mode, this means that the Information Store is taking a long time to process user requests. If most Outlook 2003 users are in Cached Mode, this threshold increases to 100 milliseconds. Typically, if the Information Store is taking a long time, there is a disk bottleneck.
The recommended values for the Avg Disk Sec/Read counter and for the Avg Disk Sec/Write disk counter are as follows:
Good < 20 msec
Fair < 30 msec
Poor < 40 msec
Cache/Exec < 1 msec
Cache/Good < 2 msec
Cache/Fair < 4 msec
If the counters are greater than .050 seconds (50 msec), there is most likely a disk bottleneck.
Note It is not unusual to see brief spikes that are greater than .050, but if you are seeing counters greater than .050 for 30 to 60 seconds at a time, there probably is a problem.
To determine if there is a problem with the current disk queue length, see how frequently the value drops to zero. If the queue length drops to zero periodically, such as four times per minute, the queue is being cleared, and you probably do not have a disk bottleneck.
it is a good idea for the Log Record Stalls/sec counter to remain at 0. If you are seeing a high number of log stalls on an Exchange 2000 Server computer, change the value of the msExchESEParamLogBuffers property. For more information about changing the value of the msExchESEParamLogBuffers property, click the following article number to view the article in the Microsoft Knowledge Base:
328466 (http://support.microsoft.com/kb/328466/) ESE log buffers that are set too low can cause the Microsoft Exchange Information Store service to stop responding
If the Cancel Request dialog box references a global catalog server that has a fully qualified domain name (FQDN), configure Performance Monitor to monitor the % Processor Time counter on the global catalog server to make sure it is not too high. A value such as > 90 over a sustained period is too high. If the % Processor Time counter is high, you have an overloaded global catalog server. For additional information about using Performance Monitor, click the following article number to view the article in the Microsoft Knowledge Base:
811237 (http://support.microsoft.com/kb/811237/) How to capture performance data from a remote Windows 2000 computer using System Monitor
Troubleshoot network issues
Use Network Monitor or another protocol sniffer to determine whether you are experiencing problems with your network.
Discussing how to configure and to use a protocol sniffer is outside the scope of this article. However, if you are already familiar with using such a utility, it is a good idea to reproduce the issue while you monitor traffic on both the client and the server at the same time. When you analyze the data, look for retransmits. A retransmit occurs when the client or the server has to send the same packet of information again, typically because the packets are being dropped between the client and the server. Therefore, when you analyze network captures, determine if the client request is actually getting to the server or if the server is responding but the response is lost before the client receives it.
Best Regards
Oz ozugurlu
