[Last Call] Learn how to a build a cloud-first strategyRegister Now

x
  • Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 345
  • Last Modified:

MSExchangeIS (404) Unable to create the log.

This is a brand new Exchange Server. Every so often I receive this error message

Event ID: 125 - MSExchangeIS (404) Unable to create the log. The drive may be read-only, out of disk space, misconfigured, or corrupted. Error -1032.

It shuts down the Information Store and the IMS service. I can restart them and it stays running again for a couple of days until it fails with same error.
0
tom33t
Asked:
tom33t
1 Solution
 
kevalaCommented:
Exchange 5.5 sp4 ?

Anti virus.....Anti virus.....and possibly Anti virus, but i am pretty sure it is Anti Virus.

http://support.microsoft.com/default.aspx?scid=kb;en-us;Q247788

http://support.microsoft.com/default.aspx?scid=kb;en-us;Q262375

Look at the above two articles at the Microsoft website and make 100% SURE that you do NOT have file level AV scanning the exchsrvr directories. This will definitely 100% cause this.

The reason is the messages come in through the IMS, they get placed into an imcdata\in folder, within the exchsrvr folder. If the message gets scanned while it is being processed by exchange, the AV will delete the message, which then causes a fault in the store.exe which is trying to process/convert a message from the IMS that no longer exists due to AV having deleted it. When a fault such as the above occurs, the Information Store (store.exe) will shut down which due to a dependency issue, will shut the IMS down.

If you are at an earlier version of sp4 for exchange 5.5, then get sp 4 applied to update the store.exe. Sp3 store.exe is known for not recognizing some message formats and shutting down as well.

Hope this helps!

0
 
tom33tAuthor Commented:
I am running SP4 for Exchange. Let me check the AV for what level it is scanning. Thanks
0
 
vinnyd79Commented:
listening
0
 
kevalaCommented:
did my suggestion work for you? was it the AV?
0
 
GoldwingCommented:
No comment has been added lately, so it's time to clean up this TA.
I will leave a recommendation in the Cleanup topic area that this question is:
Accept Comment from kevala

Please leave any comments here within the next seven days.

PLEASE DO NOT ACCEPT THIS COMMENT AS AN ANSWER!

Goldwing
EE Cleanup Volunteer
0

Featured Post

Vote for the Most Valuable Expert

It’s time to recognize experts that go above and beyond with helpful solutions and engagement on site. Choose from the top experts in the Hall of Fame or on the right rail of your favorite topic page. Look for the blue “Nominate” button on their profile to vote.

Tackle projects and never again get stuck behind a technical roadblock.
Join Now