Tuesday, August 21, 2012

Users do not receive quota warning messages

We all know that, for better or for worse, the way Exchange calculates and sends Quota Messages changed with Exchange 2010 SP1. We also know that this has caused nothing but confusion for many Administrators out there...

In this post I will try to give an overview of the new behaviour for normal mailboxes and, more important, explain when users will actually receive these messages.

Pre Exchange 2010 SP1
In Exchange environments previous to Exchange 2010 SP1, Exchange sends a quota message to mailbox owners when a:
1. Mailbox exceeds its IssueWarningQuota limit (the lowest storage quota);
2. Mailbox exceeds its ProhibitSendQuota limit (the middle storage quota);
3. Mailbox exceeds its ProhibitSendReceiveQuota limit (the highest storage quota).

Remember that:
quota messages are sent to mailbox owners, so if a mailbox is owned by a security group (shared mailbox), quota messages are sent to the security group;
quota messages are sent with high importance and are not subject to storage quotas, which means they are always delivered even if the recipient's mailbox is full;
quotas can be configured at a mailbox or database level.

These quota messages are sent during the QuotaNotificationSchedule specified for each mailbox database, which would normally be something like every day from 4AM to 6AM:
Get-MailboxDatabase | Set-MailboxDatabase -QuotaNotificationSchedule “Mon.04:00-Mon.06:00, Tue.04:00-Tue.06:00, Wed.04:00-Wed.06:00, Thu.04:00-Thu.06:00, Fri.04:00-Fri.06:00, Sat.04:00-Sat.06:00, Sun.04:00-Sun.06:00”

During this period, Exchange goes through every mailbox in the database(s) and if any has exceeded the quota threshold, it sends the owner an e-mail. No matter if the schedule was 1h, 2h or 10h, as long as Exchange has enough time to go through every mailbox, everyone over quota receives one warning message.


Exchange 2010 SP1 Onwards
Now comes SP1 and all hell breaks loose... We still have:
the same 3 levels of quotas;
quotas configurable at the user or database level;
quota messages sent during the QuotaNotificationSchedule.

BUT.... The way these messages are generated has changed... Now, every mailbox has a flag that controls whether it is checked to see if it has exceed a quota threshold. This flag is only set if the mailbox size is more than 50% of the ProhibitSendQuota limit! Unfortunately, this flag is a system property (part of the code) and therefore not visible using MFCMapi...

Let’s take an example and imagine a mailbox currently 450MB in size. This mailbox (or its database) has IssueWarningQuota set to 400MB and ProhibitSendQuota set to 1GB. We can see the mailbox is over its warning limit but because 450MB is not over 50% of the ProhibitSendQuota (500MB), it will not be checked and will not receive a quota warning message!


On top of this, once a mailbox has been checked during the QuotaNotificationSchedule, the flag is cleared and the mailbox will not be checked again until the flag is reset. Now, here’s the problem I found: according to Microsoft documentation, this flag is reset when “either a message is saved in the mailbox or a message is submitted”. When this happens, if the mailbox size is more than 50% of the ProhibitSendQuota, the flag is reset and the mailbox will be checked during the next QuotaNotificationSchedule.

But what exactly is a saved message?! I assumed that if a user drafted a message and saved it without sending it, the flag would be reset. However, from my tests this is not the case... So far, only sending e-mails from a mailbox seems to reset this flag. This means that if you have a mailbox that only receives e-mails, it will never receive the warning message. Again, this is what I am seeing in the environment I work at and from my tests!


You might be asking why I previously emphasised the “1” in “everyone over quota receives one warning message”. By default, with SP1 the QuotaNotificationSchedule is set to run for 15 minutes every day at 1AM. If you increase this to 2h, for example, your users might receive more than one message at a time! I had cases where I had this set to run over 3h for testing purposes, and some users received 3 quota messages...


Troubleshooting
If you would like to see if/which mailboxes are over quota or received a quota message, you have a few methods:

Increase the diagnostic logging on the mailbox server you want to check:
1. Open the Exchange Management Console;
2. Choose Server Configuration;
3. Select the the server name under Server Configuration for which you want to increase logging ;
4. Choose Manage Diagnostic Logging Properties... under the Actions pane;
5. Expand MSExchangeIS;
6. Expand 900 Private;
7. Choose Storage Limits;
8. Select the Expert radio button and click Configure;
9. You don’t need to restart the MSExchangeIS service or dismount and remount the database stores;
10. The next time the QuotaNotificationSchedule runs, look for the EventID 1077 in the Application log.


Use PowerShell to check mailbox statistics:
Get-MailboxStatistics -Database MDB01 | ? {$_.StorageLimitStatus -eq "IssueWarning" -OR $_.StorageLimitStatus -eq "ProhibitSend" -OR $_.StorageLimitStatus -eq "ProhibitSendReceive"} | Select DisplayName, Alias, StorageLimitStatus

Use PowerShell to see which users received a quota message:
Get-TransportServer | Get-MessageTrackingLog -ResultSize Unlimited -Start "08/08/2012" -MessageSubject "your mailbox is" –EventID DELIVER | Select TimeStamp, Recipients, MessageSubject


Exchange 2013
I have been doing some tests with Exchange 2013 to check if the behaviour is the same, but for some reason Exchange doesn’t seem to check my mailbox for quotas...
From the screenshot below, you will see that:
1. Database DB1 has ProhibitSendQuota set to 400MB and IssueWarningQuota to 200MB;
2. My mailbox is using the database’s quota defaults;
3. My mailbox is over the IssueWarningQuota limit with a size of 246MB
4. Exchange has not set the StorageLimitsStatus for my mailbox which should say IssueWarning (if it’s the same as 2007 and 2010).

It was only when I set quota limits at the mailbox level that I started to get warning messages, so I am still trying to understand exactly what is going on with Exchange 2013...


Conclusion
To reiterate, from Exchange 2010 SP1 onwards:
Every mailbox has a flag to control if the mailbox’s quota is checked;
This flag is only set if the mailbox size is more than 50% of the ProhibitSendQuota limit;
If ProhibitSendQuota limit is not used, users will never receive a quota message; 
If the flag is set, Exchange will send a quota message during the QuotaNotificationSchedule interval and then clear the flag;
The flag is reset only when a message is sent from the mailbox;


Hope this helps clarifying the new behaviour regarding quota messages!

7 comments:

  1. Hi
    so if in our Exchange 2010 Sp2 environment we didn't set sendprohibitquota we will never get issuewarningquta ? We don't want to prohibit send emails but users should be informed that mailbox size is near limit.

    ReplyDelete
  2. Hi Remigiusz, I'm afraid that is true...
    In that case users would never be near limit but I see your point as I tried to do the same thing during a migration. Unfortunately it is not possible now...

    ReplyDelete
  3. Helpful page. Maybe you can help me understand whats happening in my environment;
    Exchange 2010
    Setting limits on the mailbox level.
    Aware of the 50% issue.
    Client only wants to ProhibitSend and never Receive.
    Set Warning limit to 6MB (for testing).
    Set ProhibitSend to 10MB
    ProhibitSendReceive NOT set.
    Use database limits NOT checked.
    Quota interval at 1AM daily.
    NEVER get any warnings.

    I have been fighting with this for a while and while the PS commands show the test mailboxes show as the appropriate 'StorageLimitStatus' nothing I do seems to generate a warning message.

    Thoughts?

    ReplyDelete
    Replies
    1. Hi!

      So I assume you are at least on SP2, is that correct?
      Have you sent any e-mails from those test mailboxes?
      Please read the 4th paragraph on the "Exchange 2010 SP1 Onwards" section (that talks about resetting the flag) to see if that might be the problem!

      That is what was causing my test mailboxes to not receive the quota notification :)

      Regards, Nuno

      Delete
  4. SP1 but I AM able to send and receive from all test mailboxes (when the Send Prohibit is relaxed or adjusted above the current size).
    I made sure to both send and receive from each test account yesterday.

    Overnight we changed the quota warning interval to hour long every other hour to be thorough, enabled Exert monitoring and rebooted the db server.
    As of this morning I still have no messages and zero Event ID 1077 events.

    Have been using Warnings greater than 50% of the Prohibit for all tests.
    T

    ReplyDelete
  5. Alright, so we found our issue.
    Seems the registry edit in the MS KB article regarding the 50% limit (http://support.microsoft.com/kb/2480474) resolved our issue.
    We had not implemented it previously as we were using a Warning greater than 50% of the Prohibit threshold but apparently there is something else at play here.

    So for anyone else inexplicably not getting Quota Warning messages I suggest implementing the registry edit in the linked MS article and see if that does the trick.

    Thanks for the assist.
    T.

    ReplyDelete
    Replies
    1. Hi T.,

      Glad it is working now! Are you referring to the "CheckWarningQuota" registry key? That KB no longer mentions a registry key so I am not sure what you did.

      Regards, Nuno

      Delete