- In the Application log on the Exchange server, you may see the following events:
Event Source: Server ActiveSync
Event ID: 3007
Description:
Exchange mailbox Server response timeout: Server: [mail.contoso.com] User: [user@contoso.com]. Exchange ActiveSync Server failed to communicate with the Exchange mailbox server in a timely manner. Verify that the Exchange mailbox Server is working correctly and is not overloaded.
Event Source: Server ActiveSync
Event ID: 3014
Description:
The Exchange mailbox Server: [mail.contoso.com] has reached its timeout threshold. The mailbox server will be protected from new requests for [60] seconds.
The maximum number of RPC requests that can execute at any given time before the Information Store begins rejecting new connections is 500 for Exchange 2007 and 2010, however the counter should remain below 70 at all times. Anything above this indicates a performance bottleneck. To confirm this behavior, one can check the Performance Monitor counter “MSExchangeIS\RPC Requests” which will show if the server is above recommended limits.
Please see http://technet.microsoft.com/en-us/library/bb201689%28EXCHG.80%29.aspx
You may also see the error returned “TooManyJobsQueued” in the W3SVC logs. See the following examples:
2010-09-09 21:35:35 W3SVC1 10.0.0.10 POST /Microsoft-Server-ActiveSync/default.eas User=<user>&DeviceId=<DeviceID>&DeviceType=<Type>&Cmd=Sync=Ping=<Data> 443 Domain\User 10.0.0.20 <UserAgent> 503 0 0
2010-09-15 00:00:02 W3SVC1 155.109.199.51 POST /Microsoft-Server-ActiveSync/default.eas Cmd=Ping&User=<User>&DeviceId=<DeviceID>&DeviceType=<Type>&Log=Error:TooManyJobsQueued_ 443 Domain\User 10.0.0.20 <UserAgent> 503 0 0
You should be able to see that the s-port or Source Port the Connection_Dropped is coming from reaches a fairly high number. For example:
2010-09-09 00:27:25 10.0.0.10 64637 10.0.0.20 443 HTTP/1.1 POST /Microsoft-Server-ActiveSync?User=<User>&DeviceId=<DeviceID>&DeviceType=<Type>&Cmd=Ping - 1 Connection_Dropped MSExchangeSyncAppPool
As the connection limit is reached, NPP is consumed and HTTP.sys begins dropping HTTP connections once the server begins to peak 100 megabytes of NPP depending on the server configuration. Once the server reaches closer to 108 megabytes, HTTP.sys will fail all connections. NPP can be checked using Task Manager and viewing Performance and checking the Kernel Memory.
For information on using Netstat, see http://technet.microsoft.com/en-us/library/cc940097.aspx For information on downloading and using TCPView, please see http://technet.microsoft.com/en-us/sysinternals/bb897437.aspx