Exchange 2010: What is Back Pressure or Event ID 15004, 15005, 15006 and 15007

Back Pressure is a monitoring function for system resources integrated into the hub transport role. For example, the utilization of the RAM and the available space on the hard disk are monitored. If a resource is heavily utilized, the back pressure function is automatically activated. Connections to the Hub Transport role are "artificially" slowed down or completely rejected. Whether connections are slowed down or rejected depends on the utilization of the resource.

A small example:

If the available disk space on which the queue is stored becomes scarce, Exchange slows down the processing of incoming messages. A connection is initially established successfully using SMTP, but as soon as the sending mail server sends the MAIL-FROM command, Exchange responds to this command with a significant delay. The sending mail server therefore has to wait longer than normal before it can successfully deliver its mail. The same principle is also used in tar pits to combat SPAM. The delay in accepting new messages is intended to ensure that the queue can be processed and does not collapse completely. If the hard disk space falls below the minimum, Exchange completely rejects incoming connections.

Back Pressure determines the utilization of the resources and then classifies them into 3 categories:

Normal: Everything is OK, none of the monitored resources are working at their limit

Medium: A monitored resource is overloaded, Back Pressure becomes active, messages from the authoritative mail domain are processed, other messages are delayed or rejected. (see above)

High: At least one of the monitored resources is completely overloaded; to protect the databases, all message transmission is switched off

These system resources are monitored:

• Used working memory of all processes
• Memory used by EgdeTransport.exe
• Available disk space on the hard disk where the queue database and its transaction logs are stored (default: C:\Program Files\Microsoft\Exchange Server\V14\TransportRoles\data\Queue)
• Number of unprocessed transactions in the working memory

How to calculate from when Back Pressure is applied:

For each monitored resource, a rule applies as to when Back Pressure becomes active. For the resource "Used working memory of all processes", the rule applies from 94% working memory utilization (without swap file) Back Pressure becomes active. 94% utilization is the High category, but Exchange does not yet reject any connections, but deletes unnecessary message elements from the working memory, for example MIME elements are removed from the working memory. However, these elements may have to be read in again from the hard disk, which results in performance losses.

For the resource "Used working memory of EdgeTransport.exe", 75% of the working memory (without swap file) is level "High", 73% is level "Medium" and everything below 71% is level "Normal".

A formula that calculates the percentage of free disk space applies to the resource "Available disk space for the transaction logs of the queues":

100 * (size of hard disk - Max(3*DatabaseCheckPointDepthMax)) / size of hard disk

The value for DatabaseCheckPointDepthMax is 512 MB by default.

The formula for the resource "Memory used for the queue database" is calculated as follows:

100 * (size of hard disk - 500MB) / size of hard disk

The two formulas each define the percentage value for the "High" level. The "Medium" level is 2 % below the "High" level and the "Normal" level is 2% below the "Medium" level

The following values apply by default for the "Number of unprocessed transactions in the working memory":

High: 200 version buckets

Medium: 120 Version Buckets

Normal: 80 Version Buckets

How to tell if back pressure is at work:

The event log shows whether Back Pressure is active. Four events indicate that Back Pressure is active, they have the event IDs 15004, 15005, 15006 and 15007. 15004 and 15005 indicate the level at which Back Pressure is currently working. 15006 indicates that there is too little free hard disk space available and 15007 stands for too little free memory. The event source is always MSExchangeTransport.