Summary
I am experiencing an abnormal and extremely large amount of network traffic between Apple ExchangeSync on macOS and a gromox server over EWS.
The issue appears to be related to the following EWS sequence:
SubscribeGetStreamingEvents
The client subscribes to all folders using a streaming subscription, and the subsequent GetStreamingEvents request generates sustained traffic of approximately 190–215 Mbit/s.
The mailbox itself is small, but several hundred GiB have been transferred through EWS in a few hours.
Environment
Server
- grommunio release:
2026.06.1-lp160.12.1
- gromox:
3.8.27.m47a2746-lp160.12.1
- grommunio-common:
29.15-lp160.26.1
- grommunio-dav:
1.6.24.84942ef-lp160.3.1
- grommunio-sync:
2.4.22.e31e33a-lp160.27.1
- grommunio-web:
3.18.81.ga5a75aaa7-lp160.508.1
- grommunio-admin-api:
1.20.8.m05fb697-lp160.23.1
- HTTPS reverse proxy in front of the gromox server
Debug packages are also installed:
- gromox-debuginfo:
3.8.27.m47a2746-lp160.12.1
- gromox-debugsource:
3.8.27.m47a2746-lp160.12.1
Client
AppleExchangeWebServices/835 ExchangeSync/2007
Other Apple EWS clients were also observed:
AppleExchangeWebServices/835 AddressBookSourceSync/2695.500.71
AppleExchangeWebServices/835 Mail/3826.700.81.1.8
However, almost all transferred data is associated with:
AppleExchangeWebServices/835 ExchangeSync/2007
Observed traffic
Aggregating the reverse proxy access logs by User-Agent showed:
673.82 GiB 149 requests AppleExchangeWebServices/835 ExchangeSync/2007
0.00 GiB 82 requests AppleExchangeWebServices/835 AddressBookSourceSync/2695.500.71
0.00 GiB 37 requests AppleExchangeWebServices/835 Mail/3826.700.81.1.8
A controlled test also produced individual long-running EWS responses of:
5.01 GiB
18.65 GiB
For the 18.65 GiB request, the observed network throughput was approximately 190–200 Mbit/s for the duration of the request.
This closely matched the real-time traffic visible on the reverse proxy.
EWS request logging
I enabled EWS request logging with:
ews_request_logging=2
ews_response_logging=0
and HTTP debug logging.
Immediately after restarting gromox-http, the Apple client sent:
[ews#1] Processing Subscribe
[ews#2] Processing GetStreamingEvents
The incoming Subscribe request was:
<?xml version="1.0" encoding="utf-8"?>
<soap:Envelope
xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"
xmlns:t="http://schemas.microsoft.com/exchange/services/2006/types">
<soap:Header>
<t:RequestServerVersion Version="Exchange2010_SP2"/>
</soap:Header>
<soap:Body>
<m:Subscribe
xmlns:m="http://schemas.microsoft.com/exchange/services/2006/messages"
xmlns:t="http://schemas.microsoft.com/exchange/services/2006/types">
<m:StreamingSubscriptionRequest SubscribeToAllFolders="true">
<t:EventTypes>
<t:EventType>CopiedEvent</t:EventType>
<t:EventType>CreatedEvent</t:EventType>
<t:EventType>DeletedEvent</t:EventType>
<t:EventType>ModifiedEvent</t:EventType>
<t:EventType>MovedEvent</t:EventType>
<t:EventType>NewMailEvent</t:EventType>
<t:EventType>FreeBusyChangedEvent</t:EventType>
</t:EventTypes>
</m:StreamingSubscriptionRequest>
</m:Subscribe>
</soap:Body>
</soap:Envelope>
The following request was:
<?xml version="1.0" encoding="utf-8"?>
<soap:Envelope
xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"
xmlns:t="http://schemas.microsoft.com/exchange/services/2006/types">
<soap:Header>
<t:RequestServerVersion Version="Exchange2010_SP2"/>
</soap:Header>
<soap:Body>
<m:GetStreamingEvents
xmlns:m="http://schemas.microsoft.com/exchange/services/2006/messages"
xmlns:t="http://schemas.microsoft.com/exchange/services/2006/types">
<m:SubscriptionIds>
<t:SubscriptionId>[REDACTED]</t:SubscriptionId>
</m:SubscriptionIds>
<m:ConnectionTimeout>30</m:ConnectionTimeout>
</m:GetStreamingEvents>
</soap:Body>
</soap:Envelope>
What appears abnormal
The large transfer does not appear to come from:
Mail EWS requests
AddressBookSourceSync
ActiveSync
CalDAV
The very large transferred volume is specifically associated with:
AppleExchangeWebServices/835 ExchangeSync/2007
After restarting gromox-http, the immediately observed EWS operations are:
Subscribe
GetStreamingEvents
No corresponding large GetItem, FindItem, or SyncFolderItems operations were observed during this test.
This suggests that the abnormal traffic may be related to the EWS streaming notification mechanism itself, for example:
an event backlog being continuously replayed;
events not being removed or acknowledged correctly;
duplicate events being generated repeatedly;
a streaming response serialization loop;
an interoperability issue between Apple ExchangeSync and gromox streaming notifications.
Expected behavior
GetStreamingEvents should provide mailbox event notifications without generating sustained traffic of hundreds of Mbit/s or responses of several GiB for a small mailbox.
Actual behavior
A single EWS connection can transfer several GiB or tens of GiB.
The behavior is reproducible after restarting gromox-http:
Apple ExchangeSync sends Subscribe;
the client subscribes to all folders;
Apple ExchangeSync sends GetStreamingEvents;
sustained high-bandwidth traffic starts;
very large response sizes are recorded by the reverse proxy.
Additional information
I deliberately did not enable EWS response logging because the responses can reach several GiB and could fill the server disk.
I can provide additional sanitized logs or perform targeted tests if needed.
Could you please advise:
whether this behavior could be related to the streaming events backlog;
how to inspect the number of pending events for an EWS streaming subscription;
whether there is a way to trace event IDs/types without logging the entire response body;
whether ews_max_pending_events should protect against this situation;
whether this is a known interoperability issue with Apple ExchangeSync/2007.
Thank you.
