We have a standalone Exchange 2010 server (Windows Server 2008r2) which sits in a rack in a colocation facility. We have about 80 mailboxes, most of which connect via Outlook Anywhere from the WAN. These clients are a mix of Outlook 2010 and Outlook 2011:Mac. There are many iPhones and Droids which use ActiveSync. No clients connect directly on the LAN. This server has no other function than Exchange and AD. (I am aware this is not best practice to have Exchange on a DC).
Our average outgoing bandwidth has always been about 630kbps. About six weeks ago our outgoing bandwidth started to spike over the course of a day, and since then our average has been about 3.2Mbps. This has resulted in bandwidth overage charges.
For what it's worth, right around the time our bandwidth spiked, there was a fiber cut in the area of the colo which resulted in many routing issues for a 12-hour period; tcp connections inbound were successful, but responses out were not. The problem has long since been rectified but I can't help but wonder if there are some residual effects from this on the server, or if it is just coincidence.
I have been using Exmon to regularly monitor bytes out/user, but the data is inconclusive. In one sample (30 minutes) I may have one user with high bytes out, but in the next samples their bytes out are low and another user is high. I've also been capturing packets and reporting from our firewall, but this only tells me outbound traffic statistics by IP address; I have no way of tracing that IP address back to an actual Exchange user, especially when the majority of our users are highly mobile.
I am hoping someone here can offer some tactics I can use to pinpoint the problem. I strongly suspect a sync issue with one of the Outlook clients but I am unable to narrow it down to a specific user. Any help is greatly appreciated. Thank you,
AndrewASK