Understanding the back presure feature of Exchange 2013

Exchange 2013 uses a feature called back pressure to attempt to cope wih situations where the server is unable to copy with the volume of mailflow on either the Mailbox transport service of the Edge Server - due to either lack of disk (this may be the queue database or logs hosted on another drive) or memory on the server. When back pressure is enabled either a portion or all of the emails are rejected and dependent of setup users can recieve NDR's (Non-Delivery Reports), although Exchange will also right to the event log with specific ID's:

Event ID 15004: Resource pressure increased (e.g. from medium to high)
Event ID 15005: Resource pressure decreased (e.g. from high to medium)
Event ID 15006: Low available disk space
Event ID 15007: Low available memory

In order to monitor these alerts you could use SCOM (System Centre Operations Manager) or a monitoring application that can monitor event logs e.g. SolarWinds.

Back-pressure has three levels:
- Normal: Indicates the transport service is running as intended.
- Medium: Indicates that there is pressure, typically only allows internal mailflow, external mail flow (i.e. to and from the internet) will be rejected.
- High: Indicates that the transport service is undergoing a severe amount of pressure, typically all mailflow (both internally and externally) is rejected.

You can also quickly view these events using powershell:

Get-EventLog -ComputerName mbox01 -LogName Application -After (Get-Date).AddDays(-1) | where {$_.EventID -eq "15004"}

Or better yet there is a script available on the TechNet library that does all of the hardwork for you!

On a lower level, Exchange will also log errors to the protocol logs (if configured) under the status code 4.X.X.

Back-pressure can be customized pretty extensively (e.g. in terms of trigger levels of disk space etc.) by simply modifiyng the following file:

C:\Program Files\Microsoft\Exchange Server\V15\Bin\EdgeTransport.exe.config