Understanding Edge Servers synchronization process in Large Environment

I have no doubt EDGE server will shake the market soon enough. Third party appliance is going to have hard time to keep up with EDGE server in corporate environment as well as other platform. Corporate networks are going to save big $$$$ by implementing and taking advantage from EDGE server, introduced in Exchange 2007, role based granular implementation

Let's take a quick look the pin points for EDGE server.

Edge transport server

• Implemented in DMZ
  
• Stand Alone server ( Can be a Member server DMZ type of domain)
  
• Used ADAM ( Active Directory Application Mode) as its database
  
• ADAM database, consist mail enabled objects information and routing information
  
• EDGE transport server subscribes to the Exchange Organization, by using EdgeSync service
  
• EdgeSync replicated data (enabled objects information and routing information) from AD, service to the ADAM directory on EDGE server
  
• ADAM is local Database.
  
• EdgeSync synchronization process, also involves in configure Send connectors and configuration objects that are common to both the Exchange organization and the Edge Transport server on a Hub Transport server and then have that data automatically populated to ADAM
  
• EDGE Server ONLY Talks to the HUB server.
  
• EdgeSync service is the data synchronization service that periodically replicates configuration data from Active Directory to a subscribed Edge Transport server
  
• The Microsoft Exchange EdgeSync service runs on all Hub Transport servers under the context of the Local Service account
  
• Data is pushed from Active Directory to the EDGE server ( One WAY, from inside out to the DMZ)
  
• Microsoft Exchange EdgeSync service uses TCP port 50636 for secure LDAP communications
  
• modify
  the secure LDAP port that is used to connect to ADAM is possible ( use the ConfigureAdam.ps1 script)
  
• Configuration objects and recipient data are populated to ADAM during initial replication. The initial replication process can take a long time if you have a large quantity of recipient data
  
• Replicated Data in ADAM
  

  Edge Subscription information,
  

  Configuration information,
  

  Recipient information,
  

  Topology information
  

• All proxy addresses assigned to each recipient are replicated to ADAM as hashed data; SHA-256 generates a 256-bit message digest of the original data. Storing proxy addresses as hashed data helps secure this information in case the Edge Transport server or ADAM is compromised.
  
• What is to lose is ADAM gets hacked? SMTP Proxy addresses are hashed data 256Bit, Safe sender list is hashed also as well as Per Recipient anti-spam settings
  
• The recipient information that is replicated to ADAM includes only a subset of the recipient attributes.
  

Oz Ozugurlu

ESEUTIL in Exchange 2007 and lost log resilience (LLR)

Below information is collected from internet as it is, to have it here available for all of us. I have included the links pointing original location of the post. I will be keep posting handy little articles as I come across. I just want to point out the new future called "Lost Log Resilience and Transaction Log Activity in Exchange 2007". LLR enables to recover Exchange databases even if one or more of the most recently generated transaction log files have been lost or damaged

The Exchange Server Database Utilities (Eseutil.exe) is a tool that you can use to verify, modify, and repair an Exchange database file. When a database is corrupt or damaged, you can restore data from backup or repair it using ESEutil. ESEutil works with the Extensible Storage Engine (ESE), database files, and log files associated with a Microsoft Exchange database.

ESEutil is located in the Exchange default install folder, which is

<SystemDrive>:\Program Files\Microsoft\Exchange Server\Bin.

ESEutil can be used against any ESE database in Exchange Server 2007. In the past, ESEutil could only be used with mailbox and public folder ESE databases, but with Exchange 2007, ESEutil can be used with ESE databases on the Exchange 2007 Hub Transport and Edge Transport server roles as well.

ESEutil can be run on one database at a time from the command prompt. You can use ESEutil to perform a range of database tasks including repair, offline defragmentation, and integrity checks. Table 1 lists the most common ESEutil switches.

ESEutil examines the structure of the database tables and records at the low level of the database (Ese.dll). You can use the defragmentation mode to compact a database offline. Other ESEutil modes such as repair, recovery, and restore can be used to repair a corrupt or damaged database. Modes like integrity, file dump, and checksum can be used to verify the state of a database

ESEutil mode	Switch	Description
Defragmentation	/D	Defragments the database offline but leaves the new, defragmented database in the temporary location with or without overwriting the original database. This mode reduces the gross size on the disk of the database (.edb) by discarding most empty pages and by rebuilding indexes.
Repair	/P	Repairs a corrupt offline database by discarding any pages that cannot be fixed. In repair mode, the ESEutil tool fixes individual tables but does not maintain the relationships between tables. Use the Information Store Integrity Checker (Isinteg.exe) tool to check and fix links between tables if the repaired database is a mailbox or public folder database.
Restore	/C	Displays restore log file (Restore.env file) and controls hard recovery after restoration from legacy online backups.
Recovery	/R	Replays transaction log files or rolls them forward to restore a database to internal consistency or to bring an older copy of a database up to date.
Integrity	/G	Verifies the page level and ESE level logical integrity of the database. Does not verify integrity at the application level. Application-level logical integrity can be verified with ISinteg for mailbox and public folder databases.
File Dump	/M	Displays headers of database files, transaction log files, and checkpoint files. Also displays database page header information, and database space allocation and metadata.
Checksum	/K	Verifies checksums on all pages in the database, log files, and checkpoint files.
Copy File	/Y	Performs a fast copy of very large files.

ESEutil /R Recovery Mode

• Hard recovery A transaction log replay process that occurs after restoring a database from an online backup. Hard recovery occurs when transaction log files must be replayed into a restored online backup. In all other recovery scenarios, soft recovery is done. Hard recovery can be done with Exchange Server Database Utilities (Eseutil.exe) by using the Restore mode (/C).
  
• Soft recovery A transaction log replay process that occurs when a database is remounted after an unexpected stop, when transaction logs are replayed into an offline file copy backup of a database, or when logs are replayed into a Volume Shadow Copy Service (VSS) backup set. In the default soft recovery scenario, an external event unexpectedly stops an Exchange database, but the database and log files remain intact and in place. When the database is mounted again, Exchange reads the checkpoint file and begins to replay the transaction log that is listed as the checkpoint log. If no checkpoint file exists, replay begins with the oldest log file available in the transaction log folder for the storage group.
  

  Exchange writes to the database files completed transactions found in the log file that have not already been written and reverses any incomplete transactions. Exchange never begins writing a transaction into the database files until all the operations composing it have been secured to the log files. You do not need to physically undo or stop a transaction in the database if all uncommitted transaction logs present at the time of the unexpected stop are present when replay begins
  

  Recovering a database with missing log files
  

• In Exchange Server 2007, a new feature called Lost Log Resilience (LLR) protects Exchange databases from losing the last few log files and enables faster recovery. When an LLR-protected log file is missing or corrupt, normal database mount or recovery with ESEutil fails without the new /A recovery option. An event log with Event ID 523 states the type of failure. You can run ESEutil recovery on a database when an LLR-protected log file is missing or corrupt by using the /A option in recovery mode as follows:
  

  ESEUTIL /R Enn /A
  

  http://technet.microsoft.com/en-us/library/bb123479.aspx
  

  Oz Ozugurlu
  

Checkpoint depth is 20MG per Storage Group in Exchange 2007

Isn't this the case with 32 bits version of Exchange servers (exchange 2000 and 2003?). Yes It is. The Checkpoint depth was 20MG and is in deep 20-MB in new 64 bit architecture with Exchange 2007.

Lets understand what checkpoint depth is, speaking of exchange and its database. In exchange ESE (Extensible Storage Engine) writes storage group database transactions to logs, and then it writes them to the database. The maximum amount of data ESE can write to logs, before it writes to the database is known as the log checkpoint depth.

ESE Writes SG transaction into the à	Database Transaction Logs	ESE Writes Transaction logs to the --à	DataBase

The maximum amount of data that the Extensible Storage Engine can write to logs before it writes to the database is known as the log checkpoint depth.

The default log checkpoint depth is 20 megabytes (MB). Therefore, 20 MB of logs may have to be written to the databases before an Information Store shutdown is initiated

Therefore, the time that is required for the Exchange virtual server to move depends on the time that is required for the transaction logs to be written to the databases. By reducing the log checkpoint depth, you can reduce the write timings. By reducing the write timings, you reduce the failover times.

Read more

The ESE database engine can maintain a file up to 16 terabytes. Checkpoint depth for Exchange is 20MB per SG. With Exchange 2007 the maximum number of databases per server is increased from 20 to 50. 50 databases can be in one

• Continuous replication only allows one database per storage group.
  

• The number of databases in one SG is limited to 5
  
• The default log checkpoint depth is 20 megabytes (MB) in SG (storage Group) Database.
  

50 databases in Exchange 2007 in total with 5 databases limit in each SG will provide 10SG with 5 databases in each or 50SG one DB in each SG. (Or depending upon your needs, sixe the SG and number of DB in each SG)

By looking at the above bullet points, designs your exchange infrastructure, and calculate the Checkpoint depth and the options for going one SG with one DB or in each SG multiple DB's.

Read more

Best Regards,

Oz Ozugurlu

Problem sending mail to AOL

Most of the Time issues can be narrowed by performing the simple approach. First of all collect the necessary information such as recipient mail address. Let's say the recipient mail address is John@Aol.com.Go to DNS Report.com and on the left upper cornet paste the mail address of recipient and perform the mail test, by clicking the mail test icon.

Wait for the results and look for SMTP error code. Come back to SMTP25.BlogSpot.com and look it up the error Code or Google it. Open your DOS window and perform Telnet session back to the recipient mail server, watch for response back from the mail server. AOL trouble shooting is easy just click the link below

Troubleshooting AOL E-mail Delivery

• Check all the possible reasons below, if you are having trouble to send mail to certain domains
  
• Make sure you have RDNS for your domain.
  
• Make sure you are not on the any of the RBL list
  
• Make sure you are not on Yahoo black list ( call yahoo)
  
• Make sure there is no Cisco Firewall issue (article id 828263)
  
• http://support.microsoft.com/kb/828263
  

  Enable SMTP logging on your default virtual server.
  

  To turn on Diagnostics Logging on the MSExchangeTransport service, follow these steps:
  

  • Start Exchange System Manager.
    
  • Expand Servers, right-click Your_ Server_Name, and then click Properties.
    
  • Click the Diagnostics Logging tab, and then click MSExchangeTransport under Services.
    
  • Under Categories, click the category that you want to log.
    
  • Under Logging Level, click the appropriate logging level for the issue that you are investigating:
    
  • None
    
  • Minimum
    
  • Medium
    
  • Maximum

  Note: to see event messages turn up the logging level to medium or high. Check to see if you receive the following event messages in Events viewer with event logging turned on. Make sure you do not have any antivirus software blocking the mails such as Symantec Antivirus, Enable Internet E-mail Auto-Protect" option.

  • Add your external DNS into SMTP server properties ( I did not like this solution)
    
  • Open your Exchange system manager-> Administrative groups->First Administrative group->Servers-Your Server->Protocols->SMTP->Right Click Default Virtual Server->Properties->Delivery->Press Advanced Button->Press Configure Button near the Configure external DNS servers->In The exchange 2k3 system attendant.
    
  • go to Properties of Default SMTP Virtual Server
    
  • Delivery Tab >Advanced button >Configure Button
    
  • Now I added my ISP's 'Resolvers' not DNS servers (VERY IMPORTANT) and I moved one of theirs to the top...didn't work in second or third position for some reason.
    
  • Stop and Restart Default SMTP Virtual Server.

  Go to Queue and watched aol.com and yahoo.com roll on out....no reboot necessary
  

  1. True DNS problems
  

  • Firewall issue - UDP packet
    
  • No external DNS - Use external DNS or 'Resolver' (not sure if that is correct)
    
  • DNS server running slow or spotty and fails to return correct IP - (fix DNS server)
    
  • user is rejected or all mail rejected (ensure that a PTR - reverse DNS entry is available for your Email server's FQDN)
    

  2. Anti-Virus/Third party program
  

  • Virus/Third party program's Smart host/DNS is not set correctly
    
  • Specific Virtual SMTP server is not set to use Anti-Virus Smart host

  3. Exchange problem
  

  • DNS lookup returns MX record of a machine that does not respond, but exchange will not use the second MX record, and instead uses A record to get the IP. (work around - Use Smart Host so that multiple MX servers will be tried)
    

  
  

  • b. DNS lookup fails due to unknown reason, and Exchange uses A record not MX record. (unknown)
    

  4. Client Problem / Outlook issue
  

  • signature causes problem somehow, believe or not
    

The final trouble shooting TIP is, upgrade your mail server to Exchange 2007 to make it robust (- :

Spamless days

Regards

Oz Ozugurlu