MSExchangeTransport 10002

This article provides an explanation and possible resolutions for a specific Exchange event. If you don't find what you’re looking for here, try searching Exchange 2010 Help.

Details

Explanation

This Information event indicates that an e-mail message has been moved to the Poison message queue in the Microsoft Exchange Server 2010 transport pipeline.

Exchange 2010 uses an ESE database to store messages for routing throughout an Exchange organization. On servers that run the Edge Transport role, the database queues messages that are received from or directed to the Internet. On servers that run the Hub Transport role, the database queues messages that are transferred throughout the Exchange organization. Exchange 2010 includes the following transport queues:

• Submission queue

• Mailbox delivery queue

• Remote delivery queue

• Poison message queue

• Unreachable queue

The Microsoft Exchange Transport service creates these queues for temporary message storage as the service transfers messages through the transport pipeline.

The Poison message queue is used to store messages that cause the Microsoft Exchange Transport service to crash during message processing. This is designed to help prevent a scenario in which a damaged or malformed message causes Exchange to enter a crash/restart loop.

The Poison queue is configured with a message threshold. When a message causes the Microsoft Exchange Transport service to crash, the PoisonCount value is incremented by one. When the PoisonCount value meets the threshold, the Microsoft Exchange Transport service moves the message to the Poison message queue. Queue settings are stored in the EdgeTransport.exe.config file. This file is an XML application configuration file that is associated with the EdgeTransport.exe file. For more information, see the "Options for Configuring the Queue Database" section in Understanding Transport Queues.

If the Poison message queue contains a lot of messages, it could indicate a problem in the transport pipeline, such as that the server is receiving malformed spam messages or that malformed messages are being sent intentionally to the server.

For more information about the transport pipeline in Exchange 2010, see Understanding Transport Pipeline.

To obtain transport architecture diagrams, see the Exchange Server Team blog article Exchange 2010 Transport Architecture Diagrams Available for Download.

The content of each blog and its URL are subject to change without notice. The content within each blog is provided "AS IS" with no warranties, and confers no rights. Use of included script samples or code is subject to the terms specified in the Microsoft Terms of Use.

User Action

No user action is required. However, it is best to monitor this event to determine whether the number of messages in the queue grows. To troubleshoot this issue, do one or more of the following:

• Review the Application log and System log on your Exchange 2010 servers for related events. For example, events that occur immediately before and after this event may provide more information about the root cause of this error.

• Review the Operations Console in Operations Manager for detailed information about the cause of this problem. For more information, see the "Introduction" section in this article.

• You may want to increase diagnostics logging to log the components in the transport pipeline. To increase diagnostics logging for the Transport components, follow these steps:

  1. In the Exchange Management Console, expand Server Configuration, and then click Hub Transport.

     Note   For and Edge Transport server, click Edge Transport.

  2. In the Actions pane, click Manage Diagnostic Logging Properties for the appropriate server.

  3. Expand MSExchangeTransport.

  4. Click the following components, click Expert, and then click Configure for each component:

  • Smtpreceive

  • Smtpsend

  • DSN

  • Components

  • Remote Delivery

  • Categorizer

• Use the Queue Viewer tool in Exchange 2010 Toolbox to view the message queues. For more information about how to view queued messages, see View Queued Message Properties. For more information about how to manage message queues, see Managing Transport Queues.

• Resolve your issue by using self-support options, assisted support options, and other resources. You can access these resources from the Exchange Server Solutions Center. From this page, click Self-Support Options in the navigation pane to use self-help options. Self-help options include searching the Microsoft Knowledge Base, posting a question at the Exchange Server forums, and other methods. Alternatively, in the navigation pane, you can click Assisted Support Options to contact a Microsoft support professional. Because your organization may have a specific procedure for directly contacting Microsoft Product Support Services, be sure to review your organization's guidelines first.

For More Information

If you are not already doing so, consider running the Exchange tools, which have been created to help you analyze and troubleshoot your Exchange environment. These tools can help make sure that your configuration aligns with Microsoft best practices. They can also help you identify and resolve performance issues and improve mail flow. To run these tools, go to the Toolbox node of the Exchange Management Console. To learn more about these tools, see Managing Tools in the Toolbox.