Exchange 2013: Back pressure event

Question

Hello all,
yesterday evening we had a back pressure event in which the 'Version Buckets' HIGH threshold was violated and the mail flow ceased for about 15'. Trying to better understand why this happened we discovered that around that time the eventid 15004 was logged,
a large message (around 87MB) was sent to the server from an application and heading to a specific external recipient.
What I cannot comprehend is how this message (if...) produced all this since there are message size limits (the defaults, 35MB) and by my logic it should never reach the transport circuit - could someone please elaborate? my scope is to ensure this is not
happening again. Below follow the event logs:
The resource pressure increased from Normal to Medium.
The following resources are under pressure:
Version buckets = 177 [Medium] [Normal=80 Medium=120 High=200]
Physical memory load = 87% [limit is 94% to start dehydrating messages.]
The following components are disabled due to back pressure:
Inbound mail submission from the Internet
Mail submission from Pickup directory
Mail submission from Replay directory
Mail delivery to remote domains
Content aggregation
Mail resubmission from the Message Resubmission component.
Mail resubmission from the Shadow Redundancy Component
The following resources are in normal state:
Queue database and disk space ("C:\Program Files\Microsoft\Exchange Server\V15\TransportRoles\data\Queue\mail.que") = 52% [Normal] [Normal=95% Medium=97% High=99%]
Queue database logging disk space ("C:\Program Files\Microsoft\Exchange Server\V15\TransportRoles\data\Queue\") = 55% [Normal] [Normal=95% Medium=97% High=99%]
Private bytes = 3% [Normal] [Normal=71% Medium=73% High=75%]
Submission Queue = 0 [Normal] [Normal=2000 Medium=4000 High=10000]
Temporary Storage disk space ("C:\Program Files\Microsoft\Exchange Server\V15\TransportRoles\data\Temp") = 55% [Normal] [Normal=95% Medium=97% High=99%]
The resource pressure increased from Medium to High.
The following resources are under pressure:
Version buckets = 295 [High] [Normal=80 Medium=120 High=200]
Physical memory load = 87% [limit is 94% to start dehydrating messages.]
The following components are disabled due to back pressure:
Inbound mail submission from Hub Transport servers
Inbound mail submission from the Internet
Mail submission from Pickup directory
Mail submission from Replay directory
Mail submission from Mailbox server
Mail delivery to remote domains
Content aggregation
Mail resubmission from the Message Resubmission component.
Mail resubmission from the Shadow Redundancy Component
The following resources are in normal state:
Queue database and disk space ("C:\Program Files\Microsoft\Exchange Server\V15\TransportRoles\data\Queue\mail.que") = 52% [Normal] [Normal=95% Medium=97% High=99%]
Queue database logging disk space ("C:\Program Files\Microsoft\Exchange Server\V15\TransportRoles\data\Queue\") = 55% [Normal] [Normal=95% Medium=97% High=99%]
Private bytes = 3% [Normal] [Normal=71% Medium=73% High=75%]
Submission Queue = 0 [Normal] [Normal=2000 Medium=4000 High=10000]
Temporary Storage disk space ("C:\Program Files\Microsoft\Exchange Server\V15\TransportRoles\data\Temp") = 55% [Normal] [Normal=95% Medium=97% High=99%]
And finally this:
The SMTP availability of the Receive connector Default was low (98 percent) in the last 15 minutes.
** Did a Get-eventlog for 15004 and this has never happened before in the past.
Thank you in advance.

Answer 1

Hi Jsof,
According to your description, I recommend you use tracking log to find out why the large message reached your exchange transport circuit. It appears to be the root cause of back pressure event.
The following article for your reference to understand message tracking:
https://technet.microsoft.com/en-us/library/bb124375(v=exchg.150).aspx
Best regards,
Please remember to mark the replies as answers if they help, and unmark the answers if they provide no help. If you have feedback for TechNet Support, contact [email protected]
Niko Cheng
TechNet Community Support