Here's an idea... http://support.microsoft.com/default.aspx?scid=kb;en-us;833817&Product=exch2 003
Have you turned up logging on the MTA and SMTP? That might give some more information... -----Original Message----- From: MS Exchange List [mailto:[EMAIL PROTECTED] Sent: Tuesday, August 03, 2004 10:56 PM To: Exchange Discussions Subject: E2K3 Server choking on a message Hello, OS:W2K3 + all critical Windows update fixes Exchange: E2K3 + SP1, 1GB memory AV: Trend 6.2 + 62-patch Problem: IS Service stops Looking for: Hotfix would be nice, but I'd settle right now on being able to trace this message to a specific mailbox(s). Anything better these days than Isinteg -dump? Going back through the logs the first problem logged appears to be: ==================================== Event Type: Error Event Source: MSExchangeIS Event Category: General Event ID: 9680 Date: 8/3/2004 Time: 3:47:12 PM User: N/A Computer: SWING Description: An unhandled exception occurred while processing message MDB=81f8cae2-4d4c-487a-b12e-a1c6bc7b46ed FID=7-17483EA MID=13-11B6A2693 in function EcGetMimeOp. Number of unhandled exceptions while processing this message: 1 Number of unhandled exceptions allowed before the message is blocked: 2 ======================================= This is followed 6 seconds later with: ================================ Event Type: Error Event Source: Microsoft Exchange Server Event Category: None Event ID: 1000 Date: 8/3/2004 Time: 3:47:18 PM User: N/A Computer: SWING Description: Faulting application store.exe, version 6.5.7226.3, stamp 407db771, faulting module ole32.dll, version 5.2.3790.138, stamp 40566fc8, debug? 0, fault address 0x000d567a. ================================= Then some memory problems it looks like: ================================= Event Type: Information Event Source: Disk Event Category: None Event ID: 119 Date: 8/3/2004 Time: 3:47:26 PM User: N/A Computer: SWING Description: The driver for device \Device\Harddisk0\DR0 delayed non-paging Io requests for 0 ms to recover from a low memory condition. ================================== Over 11GB free on the sys/paging partition. Then a minute later: ======================== Event Type: Information Event Source: Microsoft Exchange Server Event Category: None Event ID: 1001 Date: 8/3/2004 Time: 3:48:29 PM User: N/A Computer: SWING Description: Bucket 126409825, bucket table 1, faulting application store.exe, version 6.5.7226.3, stamp 407db771, faulting module ole32.dll, version 5.2.3790.138, stamp 40566fc8, debug? 0, fault address 0x000d567a. ============================== This will continue for almost an hour, and then it finally dies with a 1000 error. I'm not seeing any post SP1 hotfixes (or on Trend) for this. This may be coloring my view of the problem, but we we're early adopters of 5.0 and 5.5 and encountered various issues with "malformed" (extra space in a mime line...), being able to crash the entire store. No clues logged back then, just a network sniffer and luck. Nice to see some logging of the problem and it attempting to recover from it. Thanks, Brent _________________________________________________________________ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Web Interface: http://intm-dl.sparklist.com/cgi-bin/lyris.pl?enter=exchange&text_mode=&lang =english To unsubscribe send a blank email to %%email.unsub%% Exchange List admin: [EMAIL PROTECTED] To unsubscribe via postal mail, please contact us at: Jupitermedia Corp. Attn: Discussion List Management 475 Park Avenue South New York, NY 10016 Please include the email address which you have been contacted with. _________________________________________________________________ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Web Interface: http://intm-dl.sparklist.com/cgi-bin/lyris.pl?enter=exchange&text_mode=&lang=english To unsubscribe send a blank email to [EMAIL PROTECTED] Exchange List admin: [EMAIL PROTECTED] To unsubscribe via postal mail, please contact us at: Jupitermedia Corp. Attn: Discussion List Management 475 Park Avenue South New York, NY 10016 Please include the email address which you have been contacted with.
