Worth looking into. Thanks, John.
Regards, - Bob -----Original Message----- From: Matteson, John H Jr USA Mr USA 25th SigBN (ITT) [mailto:[EMAIL PROTECTED] Sent: Saturday, March 01, 2008 8:32 PM To: MS-Exchange Admin Issues Subject: RE: How to pinpoint source of high traffic volume You can download (can remember the exact name of the product) Foglight or Searchlight for Exchange. It can suck up all the transaction logs/tracking logs on a server and give you a quick overview of who's sending what. Then again, Crystal Reports can do the same thing for you, if you have someone that can set it all up. There were some templates for early Exchange, 4.0 or 5.0, that were given away for free, but I'm not sure for E2k, E2k3 or E2k7. John H. Matteson, Jr. Systems Administrator/ITT Systems FOB Orgun-E Afghanistan DSN - 318 431 8001 VoSIP - (308) 431 - 0000 Iridium - 717.633.3823 Roshain - 079 - 736 - 3832 "A man who thinks of himself as belonging to a particular national group in America has not yet become an American. And the man who goes among you to trade upon your nationality is no worthy son to live under the Stars and Stripes." Woodrow Wilson -----Original Message----- From: Bob Peitzke [mailto:[EMAIL PROTECTED] Sent: Friday, February 29, 2008 11:08 PM To: MS-Exchange Admin Issues Subject: RE: How to pinpoint source of high traffic volume I didn't see anything stuck in any of the message queues. Msg limits - global: 100 MB; connector: no "allowed sizes" limit; SMTP virtual server: no limit. This is in our Paris office. I don't know of any Mac users there. It's back to normal now, so no panic. But it made me realize that I need a better way to analyze traffic surges. - Bob ________________________________ From: Michael B. Smith [mailto:[EMAIL PROTECTED] Sent: Friday, February 29, 2008 9:41 AM To: MS-Exchange Admin Issues Subject: RE: How to pinpoint source of high traffic volume Look at the message queues. If you see nothing there - hmmm. Do you have Mac users with Entourage? Do you have a message size limit? Regards, Michael B. Smith MCSE/Exchange MVP http://TheEssentialExchange.com From: Bob Peitzke [mailto:[EMAIL PROTECTED] Sent: Friday, February 29, 2008 12:32 PM To: MS-Exchange Admin Issues Subject: How to pinpoint source of high traffic volume This morning I noticed one of our Exchange 2000 servers has an abnormally high number of log files, and seems to be filling one about every 5 - 10 minutes. Since no mailboxes have grown, I figure it must be outbound traffic, as if a PC is acting as a spam zombie. Relaying is restricted to three specific hosts within subnet. There must be a way to pinpoint the source of the traffic, right? Turn up some logging? I'm looking for it, but would appreciate advice from someone who works in this area more often than I do. Grateful for any advice. Bob Peitzke Senior IT Manager Colony Advisors, LLC Century City, CA, USA Email: [EMAIL PROTECTED] ~ Ninja Email Security with Cloudmark Spam Engine Gets Image Spam ~ ~ http://www.sunbeltsoftware.com/Ninja ~ ~ Ninja Email Security with Cloudmark Spam Engine Gets Image Spam ~ ~ http://www.sunbeltsoftware.com/Ninja ~
