Hello, Finally manually tracked down the message. Disappointing that apparently no tool exists (I even opened a case with PSS...) to locate a message when an EventID gives you a specific MID.
The message Imports and Exports to PST just fine. When viewed with OWA or IMAP it will crash the entire sever. The current OUTLOOK version on my test lab doesn't like it either, but it doesn't cause the store to crash. It could be a 1 in a billion fluke you'll never see, but in case anyone is as unlucky as us here's an overview of what I did: -App log contains MDB, FID, and MID (eventid 9680). Isinteg -dump will let you locate the MDB and FID, FID's Root folder will point you to the specific Mailbox. -Mailbox, and anyone who accesses it, gets moved off production Email server to "bad people's" server. -Exported mailbox to PST, reimported into another mailbox. (So I could mess with it without disturbing the user) -Used OUTLOOK EXPRESS IMAP4 Account to "Sync" every folder. It'll lock up on the problem message (or seemingly the one just before it), and Store will start throwing errors. -Moved bad message to "Clean Lab" (nothing of our environment) to make sure it's an "exchange" thing and not something peculiar with our setup. In the test lab I was able to fault the store with the message several times without generating the 9680 error, it would just log some "eventid 1000" errors (store faulting) and shutdown. What a bummer that would be to not even be able to trace it to a mailbox. If that happened I'd probably bump up logging on all protocols and move every mailbox that logged on anywhere near the event. Brent -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of MS Exchange List Posted At: Wednesday, August 04, 2004 4:11 PM Posted To: MS Exchange List Conversation: E2K3 Server choking on a message Subject: RE: E2K3 Server choking on a message Thanks. I thought from the date on that KB it was probably in SP1. But, I've found a credit card here at work so I'll be calling PSS shortly. :-) With ISINTEG Dump I was able to trace the FID and MDB to one of our databases and to a specific Mailbox: ============== [7374] Folder FID=000D-000005842C9E Parent FID=0007-0000017483EA Root FID=0007-0000017483E4 Folder Type=1 Msg Count=0 Msgs Unread=0 Msgs Submitted=0 Rcv Count=0 Subfolders=0 Name=Drafts Comment=Drafts folder Restriction= Search FIDs=0001-00000007E533 Scope FIDs(search folder only)= Recursive FIDs= Search Backlinks=0006-0000007792AF,0001-00000007E533 Categ FIDs= ================ Whose mailbox is this: ================ [47] RootFID=0007-0000017483E4 Owner DN=???????? GUID=DBC56383 A216D211 84410080 5F15202E Display Name="Guilty username removed" Comment= Sentmail FID=0001-0000D6F4BC77 Subtree=0007-0000017483E5 Inbox=0007-0000017483E6 Outbox=0007-0000017483E7 Sentmail=0007-0000017483E8 Finder=0007-0000017483EA DAF=0007-0000017483EB Spooler Q=0007-0000017483EC Size=(ec:ecNotFound-MAPI_E_NOT_FOUND) Localized=TRUE Locale=0x409 ============== And this user is a MAC user that is probably using entourage or something like that and IMAPing off the server. So maybe one of those "content conversion" problems. Although this persons mailbox gets accessed by a few others who are OUTLOOK users, and during this time frame I'm only seeing them as "authenticating" in the security log. They all get their own Exchange server away from everyone else tonight/morning until we can get a fix for this. Any tool to associate the MID with a Subject line or something like that? Brent -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Ely, Don Posted At: Tuesday, August 03, 2004 8:07 PM Posted To: MS Exchange List Conversation: E2K3 Server choking on a message Subject: RE: E2K3 Server choking on a message Here's an idea... http://support.microsoft.com/default.aspx?scid=kb;en-us;833817&Product=e xch2 003 Have you turned up logging on the MTA and SMTP? That might give some more information... -----Original Message----- From: MS Exchange List [mailto:[EMAIL PROTECTED] Sent: Tuesday, August 03, 2004 10:56 PM To: Exchange Discussions Subject: E2K3 Server choking on a message Hello, OS:W2K3 + all critical Windows update fixes Exchange: E2K3 + SP1, 1GB memory AV: Trend 6.2 + 62-patch Problem: IS Service stops Looking for: Hotfix would be nice, but I'd settle right now on being able to trace this message to a specific mailbox(s). Anything better these days than Isinteg -dump? Going back through the logs the first problem logged appears to be: ==================================== Event Type: Error Event Source: MSExchangeIS Event Category: General Event ID: 9680 Date: 8/3/2004 Time: 3:47:12 PM User: N/A Computer: SWING Description: An unhandled exception occurred while processing message MDB=81f8cae2-4d4c-487a-b12e-a1c6bc7b46ed FID=7-17483EA MID=13-11B6A2693 in function EcGetMimeOp. Number of unhandled exceptions while processing this message: 1 Number of unhandled exceptions allowed before the message is blocked: 2 ======================================= This is followed 6 seconds later with: ================================ Event Type: Error Event Source: Microsoft Exchange Server Event Category: None Event ID: 1000 Date: 8/3/2004 Time: 3:47:18 PM User: N/A Computer: SWING Description: Faulting application store.exe, version 6.5.7226.3, stamp 407db771, faulting module ole32.dll, version 5.2.3790.138, stamp 40566fc8, debug? 0, fault address 0x000d567a. ================================= Then some memory problems it looks like: ================================= Event Type: Information Event Source: Disk Event Category: None Event ID: 119 Date: 8/3/2004 Time: 3:47:26 PM User: N/A Computer: SWING Description: The driver for device \Device\Harddisk0\DR0 delayed non-paging Io requests for 0 ms to recover from a low memory condition. ================================== Over 11GB free on the sys/paging partition. Then a minute later: ======================== Event Type: Information Event Source: Microsoft Exchange Server Event Category: None Event ID: 1001 Date: 8/3/2004 Time: 3:48:29 PM User: N/A Computer: SWING Description: Bucket 126409825, bucket table 1, faulting application store.exe, version 6.5.7226.3, stamp 407db771, faulting module ole32.dll, version 5.2.3790.138, stamp 40566fc8, debug? 0, fault address 0x000d567a. ============================== This will continue for almost an hour, and then it finally dies with a 1000 error. I'm not seeing any post SP1 hotfixes (or on Trend) for this. This may be coloring my view of the problem, but we we're early adopters of 5.0 and 5.5 and encountered various issues with "malformed" (extra space in a mime line...), being able to crash the entire store. No clues logged back then, just a network sniffer and luck. Nice to see some logging of the problem and it attempting to recover from it. Thanks, Brent _________________________________________________________________ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Web Interface: http://intm-dl.sparklist.com/cgi-bin/lyris.pl?enter=exchange&text_mode=&; lang =english To unsubscribe send a blank email to %%email.unsub%% Exchange List admin: [EMAIL PROTECTED] To unsubscribe via postal mail, please contact us at: Jupitermedia Corp. Attn: Discussion List Management 475 Park Avenue South New York, NY 10016 Please include the email address which you have been contacted with. _________________________________________________________________ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Web Interface: http://intm-dl.sparklist.com/cgi-bin/lyris.pl?enter=exchange&text_mode=&; lang=english To unsubscribe send a blank email to %%email.unsub%% Exchange List admin: [EMAIL PROTECTED] To unsubscribe via postal mail, please contact us at: Jupitermedia Corp. Attn: Discussion List Management 475 Park Avenue South New York, NY 10016 Please include the email address which you have been contacted with. _________________________________________________________________ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Web Interface: http://intm-dl.sparklist.com/cgi-bin/lyris.pl?enter=exchange&text_mode=&lang=english <http://intm-dl.sparklist.com/cgi-bin/lyris.pl?enter=exchange&text_mode=<=english> To unsubscribe send a blank email to %%email.unsub%% Exchange List admin: [EMAIL PROTECTED] To unsubscribe via postal mail, please contact us at: Jupitermedia Corp. Attn: Discussion List Management 475 Park Avenue South New York, NY 10016 Please include the email address which you have been contacted with. _________________________________________________________________ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Web Interface: http://intm-dl.sparklist.com/cgi-bin/lyris.pl?enter=exchange&text_mode=&lang=english To unsubscribe send a blank email to [EMAIL PROTECTED] Exchange List admin: [EMAIL PROTECTED] To unsubscribe via postal mail, please contact us at: Jupitermedia Corp. Attn: Discussion List Management 475 Park Avenue South New York, NY 10016 Please include the email address which you have been contacted with.
