Microsoft Exchange Server 2013 : Preserving information (part 7) - Resource throttling for searches

11/21/2014 3:30:38 AM

Resource throttling for searches

If you add more than 50 mailboxes to a search, you encounter a slight problem in that Exchange cannot display keyword statistics for the search simply because the search is likely to impose a large overhead on servers to gather the keywords when information from more than 50 mailboxes is reviewed. The error message EAC displays (Figure 16) is a little misleading because you might assume that Exchange is limited in terms of the number of mailboxes that search supports. You can still perform an estimate of a search, review search results, retrieve information, and store it in a search mailbox, even if you lack one of the very useful tools available in Exchange to assess search effectiveness.

If you add more than 50 mailboxes to a search and haven’t adjusted the throttling policies, you see an error similar to the one shown here.

Figure 16. Error displayed when more than 50 mailboxes are added to a search

The resources any Exchange process can consume are constrained by throttling policies. You can amend the policy to increase the number of resources available to searches. First, to see the categories of search resources the default throttling policy governs, run the Get-ThrottlingPolicy command:

Get-ThrottlingPolicy | Format-List *Discovery*

The following list describes the meanings of the settings that govern searching:

DiscoveryMaxConcurrency The maximum number of searches a single user can perform concurrently

DiscoveryMaxMailboxes The maximum number of mailboxes that can be searched for estimate purposes (for which you can see statistics for keywords)

DiscoveryMaxKeywords The maximum number of keywords that can be specified in the query used for an eDiscovery search

DiscoveryMaxMailboxResultsOnly The maximum number of mailboxes from which a search can copy results to a discovery mailbox

DiscoveryPreviewSearchResultsPageSize The maximum number of results that can be shown on a single page in a search preview

DiscoveryMaxKeywordsPerPage The maximum number of keywords that EAC can display on a page when viewing search statistics

The issue that you run into with mailboxes is controlled by the DiscoveryMaxMailboxes setting. By increasing this value from 50 to 120 or more (the current search covers 119 mailboxes), you won’t see the error condition afterward. However, the default global throttling policy provided with Exchange 2013, which applies to all users unless a specific throttling policy has been assigned to them, is read-only. Therefore, you must create a new throttling policy and set increased values in it and then assign that policy to the users who will run eDiscovery searches from EAC or EMS. Any value that is not set will be inherited from the global throttling policy.

To create a new throttling policy, run the New-ThrottlingPolicy command and set the scope for the new policy to Regular so it can be applied to user mailboxes:

New-ThrottlingPolicy –Name 'Discovery Throttling Policy' –ThrottlingPolicyScope Regular

Next, update whatever settings you need to increase:

Set-ThrottlingPolicy –Identity 'Discovery Throttling Policy' –DiscoveryMaxMailboxes 150 –DiscoveryMaxKeyWords 1000

Finally, assign the new policy to the users who need to run eDiscovery searches. Typically, these are the members of the Discovery Management role group.

Set-Mailbox –Identity 'Tony Redmond' –ThrottlingPolicy 'Discovery Throttling Policy'

Increasing the values for resources assigned through throttling policies should be done only when absolutely required. You do not want to order an eDiscovery search that absorbs so many system resources on a server that it cannot adequately respond to user requests.

Inside Out Memory limitations and mailbox searches

eDiscovery searches make considerable resource demands on Mailbox servers to search for and retrieve items, so Exchange 2010 limited the number of mailboxes that can be searched in a single operation to 25,000 unless you increase this number by updating the HKLM\SOFTWARE\Microsoft\ExchangeServer\v14\Discover DWORD value in the system registry. The value should be set to the number of mailboxes you want to search. Make sure that the value is set to the same number on every Mailbox server in the organization. Exchange 2013 takes a different approach; it uses throttling policies instead of registry entries, which eases the problem of making sure that every Mailbox server is configured in the same way. The value for the maximum number of mailboxes for a search is reduced to 5,000 in the default throttling policy. This reflects the experience gained with Exchange 2010, when the majority of searches scanned fewer than 5,000 mailboxes. You can increase this value, but do so only when you’re sure that such a large search is absolutely necessary.

Others

- Microsoft Exchange Server 2013 : Preserving information (part 6) - Examining search results

- Microsoft Exchange Server 2013 : Preserving information (part 5) - Retrieving discovered content

- Microsoft Exchange Server 2013 : Preserving information (part 4) - Creating a new search - Refining a search

- Microsoft Exchange Server 2013 : Preserving information (part 3) - Creating a new search

- Microsoft Exchange Server 2013 : Preserving information (part 2) - Searching mailbox content, In-place holds

- Microsoft Exchange Server 2013 : Preserving information (part 1) - Putting a mailbox on litigation hold

- Microsoft Exchange Server 2013 : How the Managed Folder Assistant implements retention policies (part 2) - Retention date calculation

- Microsoft Exchange Server 2013 : How the Managed Folder Assistant implements retention policies (part 1) - Behind the scenes with the MFA

- Sharepoint 2013 : Security and Policy - SharePoint Security Groups (part 4) - Assigning New Visitor, Member, and Owner Groups at Site Creation

- Sharepoint 2013 : Security and Policy - SharePoint Security Groups (part 3) - Creating a New Group, Deleting a Group