Thanks. I thought from the date on that KB it was probably in SP1.
But, I've found a credit card here at work so I'll be calling PSS
shortly. :-)
With ISINTEG Dump I was able to trace the FID and MDB to one of our
databases and to a specific Mailbox:
==============
[7374] Folder FID=000D-000005842C9E
Parent FID=0007-0000017483EA
Root FID=0007-0000017483E4
Folder Type=1
Msg Count=0
Msgs Unread=0
Msgs Submitted=0
Rcv Count=0
Subfolders=0
Name=Drafts
Comment=Drafts folder
Restriction=
Search FIDs=0001-00000007E533
Scope FIDs(search folder only)=
Recursive FIDs=
Search Backlinks=0006-0000007792AF,0001-00000007E533
Categ FIDs=
================
Whose mailbox is this:
================
[47] RootFID=0007-0000017483E4
Owner DN=????????
GUID=DBC56383 A216D211 84410080 5F15202E
Display Name="Guilty username removed"
Comment=
Sentmail FID=0001-0000D6F4BC77
Subtree=0007-0000017483E5
Inbox=0007-0000017483E6
Outbox=0007-0000017483E7
Sentmail=0007-0000017483E8
Finder=0007-0000017483EA
DAF=0007-0000017483EB
Spooler Q=0007-0000017483EC
Size=(ec:ecNotFound-MAPI_E_NOT_FOUND)
Localized=TRUE
Locale=0x409
==============
And this user is a MAC user that is probably using entourage or
something like that and IMAPing off the server. So maybe one of those
"content conversion" problems. Although this persons mailbox gets
accessed by a few others who are OUTLOOK users, and during this time
frame I'm only seeing them as "authenticating" in the security log.
They all get their own Exchange server away from everyone else
tonight/morning until we can get a fix for this.
Any tool to associate the MID with a Subject line or something like
that?
Brent
-----Original Message-----
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Ely,
Don
Posted At: Tuesday, August 03, 2004 8:07 PM
Posted To: MS Exchange List
Conversation: E2K3 Server choking on a message
Subject: RE: E2K3 Server choking on a message
Here's an idea...
http://support.microsoft.com/default.aspx?scid=kb;en-us;833817&Product=e
xch2
003
Have you turned up logging on the MTA and SMTP? That might give some
more information...
-----Original Message-----
From: MS Exchange List [mailto:[EMAIL PROTECTED]
Sent: Tuesday, August 03, 2004 10:56 PM
To: Exchange Discussions
Subject: E2K3 Server choking on a message
Hello,
OS:W2K3 + all critical Windows update fixes
Exchange: E2K3 + SP1, 1GB memory
AV: Trend 6.2 + 62-patch
Problem:
IS Service stops
Looking for:
Hotfix would be nice, but I'd settle right now on being able to trace
this
message to a specific mailbox(s). Anything better these days than
Isinteg
-dump?
Going back through the logs the first problem logged appears to be:
====================================
Event Type: Error
Event Source: MSExchangeIS
Event Category: General
Event ID: 9680
Date: 8/3/2004
Time: 3:47:12 PM
User: N/A
Computer: SWING
Description:
An unhandled exception occurred while processing message
MDB=81f8cae2-4d4c-487a-b12e-a1c6bc7b46ed FID=7-17483EA MID=13-11B6A2693
in
function EcGetMimeOp.
Number of unhandled exceptions while processing this message: 1 Number
of
unhandled exceptions allowed before the message is blocked: 2
=======================================
This is followed 6 seconds later with:
================================
Event Type: Error
Event Source: Microsoft Exchange Server
Event Category: None
Event ID: 1000
Date: 8/3/2004
Time: 3:47:18 PM
User: N/A
Computer: SWING
Description:
Faulting application store.exe, version 6.5.7226.3, stamp 407db771,
faulting
module ole32.dll, version 5.2.3790.138, stamp 40566fc8, debug?
0, fault address 0x000d567a.
=================================
Then some memory problems it looks like:
=================================
Event Type: Information
Event Source: Disk
Event Category: None
Event ID: 119
Date: 8/3/2004
Time: 3:47:26 PM
User: N/A
Computer: SWING
Description:
The driver for device \Device\Harddisk0\DR0 delayed non-paging Io
requests
for 0 ms to recover from a low memory condition.
==================================
Over 11GB free on the sys/paging partition. Then a minute later:
========================
Event Type: Information
Event Source: Microsoft Exchange Server
Event Category: None
Event ID: 1001
Date: 8/3/2004
Time: 3:48:29 PM
User: N/A
Computer: SWING
Description:
Bucket 126409825, bucket table 1, faulting application store.exe,
version
6.5.7226.3, stamp 407db771, faulting module ole32.dll, version
5.2.3790.138,
stamp 40566fc8, debug? 0, fault address 0x000d567a.
==============================
This will continue for almost an hour, and then it finally dies with a
1000
error.
I'm not seeing any post SP1 hotfixes (or on Trend) for this.
This may be coloring my view of the problem, but we we're early adopters
of
5.0 and 5.5 and encountered various issues with "malformed" (extra space
in
a mime line...), being able to crash the entire store. No clues logged
back
then, just a network sniffer and luck. Nice to see some logging of the
problem and it attempting to recover from it.
Thanks,
Brent
_________________________________________________________________
List posting FAQ: http://www.swinc.com/resource/exch_faq.htm
Web Interface:
http://intm-dl.sparklist.com/cgi-bin/lyris.pl?enter=exchange&text_mode=&;
lang
=english
To unsubscribe send a blank email to
%%email.unsub%%
Exchange List admin: [EMAIL PROTECTED]
To unsubscribe via postal mail, please contact us at:
Jupitermedia Corp.
Attn: Discussion List Management
475 Park Avenue South
New York, NY 10016
Please include the email address which you have been contacted with.
_________________________________________________________________
List posting FAQ: http://www.swinc.com/resource/exch_faq.htm
Web Interface:
http://intm-dl.sparklist.com/cgi-bin/lyris.pl?enter=exchange&text_mode=&;
lang=english
To unsubscribe send a blank email to
%%email.unsub%%
Exchange List admin: [EMAIL PROTECTED]
To unsubscribe via postal mail, please contact us at:
Jupitermedia Corp.
Attn: Discussion List Management
475 Park Avenue South
New York, NY 10016
Please include the email address which you have been contacted with.
_________________________________________________________________
List posting FAQ: http://www.swinc.com/resource/exch_faq.htm
Web Interface:
http://intm-dl.sparklist.com/cgi-bin/lyris.pl?enter=exchange&text_mode=&lang=english
To unsubscribe send a blank email to [EMAIL PROTECTED]
Exchange List admin: [EMAIL PROTECTED]
To unsubscribe via postal mail, please contact us at:
Jupitermedia Corp.
Attn: Discussion List Management
475 Park Avenue South
New York, NY 10016
Please include the email address which you have been contacted with.
