Just an update on this.
It's not happening on all of our users, just some.
By looking at the IIS transaction logs on the Exchange server that runs Activesync we could see the highest volume users and identified one in particular who has been generating up to 16GB of logs in a single week!
I've tried a couple of different 4S handsets running iOS 5 and 6 and get the same results each time, and also the same thing with an iPad on his account.
A Windows Phone 7.5 device doesn't cause any issues.
So, I've proved what's behind it but am no closer to a fix.
I have seen the issue twice in two weeks. Two different users, the commonality is both an iphone, and an ipad. In both cases the ipad was on wifi. I was able to turn on device logging in the ECP and in 20 minutes captured over 1 MB log on i-pad. I disabled the i-pad via the ecp and issue disipated.
When I reviewed the log the content that was being sync'd was over 5 months old. I instructed the user to back off to 30 days. Device is still stable, and the 30 days is just a temporary solution. I have opened a case with Microsoft for further review of the session log. What is interesting is that the log is consumed with a particular fetch and message class: ipm.note.eas <- EAS is the Exchange Archiving System stub created by Zantaz. I confirmed with our admin that we did not do any sync on the EAS server. I am looking into if the User initiated an Outlook resync of stubs.
<To xmlns="Email:" bytes="50"/>
<From xmlns="Email:" bytes="35"/>
<Subject xmlns="Email:" bytes="18"/>
<DisplayTo xmlns="Email:" bytes="16"/>
<ThreadTopic xmlns="Email:" bytes="14"/>
iOS 6.0.1 10A523
Device language: en User agent: Apple-iPhone4C1/1001.523 Device OS:
iOS 6.0.1 10A523
Device language: en User agent: Apple-iPad3C2/1001.523