iPhones using activesync causing excessive transaction log growth on Exchange 2010

Question

Level 1

1 points

iPhones using activesync causing excessive transaction log growth on Exchange 2010

Hi there.

We have around 60 iPhone or iPad users who are retrieving their emails from our Exchange 2010 SP2 servers using activesync.
Back when everyone was using the 3GS this worked just fine but late in 2011 we noticed that the transaction logs on our exchange servers were growing out of control. They should be roughly two times the volume of emails sent or received but all of a sudden we were getting fourty times as many! We only send just over 1GB of emails per week but have 50GB of transaction logs in that time.

I've spent ages trying to track down the cause and have an open TAC case with Microsoft that's been dragging on for several months now. We have recently proved that it's activesync causing the log growth - disable it and everything returns to normal - but they don't seem to be in any rush to identify a fix and I suspect their answer will be "Stop using iPhones".

Has anyone else seen this behaviour before and if so did you find a fix?

I was hoping iOS 6 might provide a solution but I'm reluctant to get everyone to upgrade because of the well publicised problems with maps and now I see that there are different Activesync bugs involving cancellation of meeting requests.

Anyone who can provide me with a resolution will win a prize as I'm at my wits end here.

Thanks

iPhone 4S, iOS 5.1.1

Posted on Oct 4, 2012 1:36 AM

Reply

Answer 1

Oct 8, 2012 10:53 AM in response to Vespa Alex

We are seeing this with iOS 6 users as well. We had seen it with users on some versions of iOS but it seemed to be resolved with an update. Don't remember specifics. We are beginning troubleshooting this as we speak, looking at offending device configs first.

Reply

Answer 2

Vespa Alex Author

Level 1

1 points

Oct 9, 2012 10:23 AM in response to SpeakertoWolves

Thanks.

As I said, I've held off getting people to upgrade to iOS 6 but it doesn't sound like that's a guaranteed fix anyway.

Reply

Answer 3

Vespa Alex Author

Level 1

1 points

Dec 14, 2012 3:31 AM in response to Vespa Alex

Just an update on this.

It's not happening on all of our users, just some.

By looking at the IIS transaction logs on the Exchange server that runs Activesync we could see the highest volume users and identified one in particular who has been generating up to 16GB of logs in a single week!

I've tried a couple of different 4S handsets running iOS 5 and 6 and get the same results each time, and also the same thing with an iPad on his account.

A Windows Phone 7.5 device doesn't cause any issues.

So, I've proved what's behind it but am no closer to a fix.

Reply

Answer 4

meiterm

Level 1

0 points

Jan 23, 2013 8:41 AM in response to Vespa Alex

I have seen the issue twice in two weeks. Two different users, the commonality is both an iphone, and an ipad. In both cases the ipad was on wifi. I was able to turn on device logging in the ECP and in 20 minutes captured over 1 MB log on i-pad. I disabled the i-pad via the ecp and issue disipated.

When I reviewed the log the content that was being sync'd was over 5 months old. I instructed the user to back off to 30 days. Device is still stable, and the 30 days is just a temporary solution. I have opened a case with Microsoft for further review of the session log. What is interesting is that the log is consumed with a particular fetch and message class: ipm.note.eas <- EAS is the Exchange Archiving System stub created by Zantaz. I confirmed with our admin that we did not do any sync on the EAS server. I am looking into if the User initiated an Outlook resync of stubs.

<Fetch>

<Body=4502 bytes/>

<MessageClass xmlns="Email:">IPM.Note.EAS</MessageClass>

<ContentClass xmlns="Email:">urn:content-classes:message</ContentClass>

</ApplicationData>

</Fetch>

device details:

Device OS:	iOS 6.0.1 10A523
Device language:	en
User agent:	Apple-iPhone4C1/1001.523

Device OS:	iOS 6.0.1 10A523
Device language:	en
User agent:	Apple-iPad3C2/1001.523

Reply