Get-LogonStatistics Shows Logons to a Mailbox on the Active Node by the Exchange Search Indexer on the Passive Node(s) of a DAG in Exchange 2010

You May See Logons to a Mailbox on the Active Node from the Passive Node of a DAG and CAS

We recently ran into a very interesting issue in which the Exchange Indexing Service on the Passive Node of a DAG was logging on a mailbox on the active node.

Here is a summary of what we were seeing:

When you run Get-LogonStatistics in the Exchange 2010 Command Shell, you may see logons to a mailbox on the active node, from the passive node(s), and from the Client Access (CAS) server(s).

Get-LogonStatistics | fl shows Application ID:client-CI (Content indexing).

If you use  Exchange Server User Monitor (ExMon), ExMon may show a large number of logon sessions for the mailbox user on the active node of a Database Availability Group (DAG).  

A Network Monitor trace from the passive node may show many connections for the Microsoft.Exchange.Search.Exsearch.exe, the MSExchange Search Indexer service, also called the Microsoft Exchange Search Indexer.  The Network Monitor trace may reveal that Microsoft.Exchange.Search.Exsearch.exe (the MSExchange Search Indexer service) on the passive node(s) is logging (machine name) on to the mailbox on the active node of the DAG.

After stopping the MSExchange Search Indexer Service on the passive node, you may see the Logon connections from the passive node drop.  After starting the MSExchange Search Indexer Service on the Passive node and after waiting some time, the passive node logs back into the mailbox on the active node again.

Explanation

We researched this issue and here is the explanation:

Exchange Search can only index a mounted database.  In an Exchange 2010 DAG, the only currently mounted copy of a database is the active node database.

The MSExchange Search Indexer service on the passive node(s) always indexes the currently active node database of the DAG (which is the only currently mounted copy of the database).

It is by Design that the Microsoft Exchange Search Indexer service on the passive node(s) indexes only the active node database. The design is that, in this way, all content indexes of the database on all database copies of the DAG are always up to date.

Written by:

Naveen Vasudevan, Acting Technical Lead, Enterprise Communications Services, Microsoft
Bob Want, Senior Support Escalation Engineer, Enterprise Communications Services, Microsoft
Rafael Mercado, Senior Support Escalation Engineer, Enterprise Communications Services, Microsoft

Technically Reviewed by:

Bob Want, Senior Support Escalation Engineer, Enterprise Communications Services, Microsoft
Jonathan Runyon, Senior Support Escalation Engineer, Enterprise Communications Services, Microsoft