?
Solved

Exchange stopped delivering messages

Posted on 2007-07-22
22
Medium Priority
?
739 Views
Last Modified: 2011-09-20
SBS 2003
 
Exchange has stopped working properly. Incoming messages are sitting in the Server Local Delivery Queue and are not being distributed to the clients. Periodically I am seeing Event 3005 being logged:

Unexpected Exchange mailbox Server error: Server: [gandalf.Merlin.local] User: [myuser@mydomain.com] HTTP status code: [500]. Verify that the Exchange mailbox Server is working correctly.

One mailbox has got forwarding to a remote mailbox setup. Messages to this account are getting through without a problem.

Anyone any ideas?

Ian
0
Comment
Question by:ipendlebury
  • 14
  • 8
22 Comments
 
LVL 74

Expert Comment

by:Jeffrey Kane - TechSoEasy
ID: 19544027
The solution is here:  http://www.chicagotech.net/troubleshooting/event3005.htm

Although I do have to wonder what was done to cause this in the first place.

Jeff
TechSoEasy
0
 

Author Comment

by:ipendlebury
ID: 19545459
Hi Jeff,

I took a look at that article. The registry key referred to does have /exchange-oma present in it.

>> Although I do have to wonder what was done to cause this in the first place

We installed an APC UPS on Friday morning. Everything was working fine afterwards. Cooincedentally, in the afternoon, the power company needed to change the electricity meter. So my customer decided to use this opportunity to test if the new ups would shut down the server gracefully. Everything apparently happened as expected, except that no-one has received any email since. The exception being myself. I have an account on that server which is forwarded to my own email address. This is still working. As I type this reply, there are 47 email sat in the local delivery queue. This queue has a status of 'retry' against it.

Ian
0
 

Author Comment

by:ipendlebury
ID: 19545496
I would mention also that OWA and OMA are not able to access any new messages.

Ian
0
Concerto Cloud for Software Providers & ISVs

Can Concerto Cloud Services help you focus on evolving your application offerings, while delivering the best cloud experience to your customers? From DevOps to revenue models and customer support, the answer is yes!

Learn how Concerto can help you.

 

Author Comment

by:ipendlebury
ID: 19545549
Ahh! I just got a slightly different story from my customer....

Apparently just after he rebooted the server, the electrician came back and said he needed to turn off the power again. He turned off the power before my customer managed to down the server, and the UPS didn't have enough power to keep the server up.

I checked the Event Log and just around the time this happened, there is a 467 error reporting a corrupted index in pub1.edb

So i'll have a go at repairing this file.

ian
0
 

Author Comment

by:ipendlebury
ID: 19545792
I did the integrity checks and even repaired the file. No problems were found. So I'm running out of ideas now.

Ian
0
 
LVL 74

Accepted Solution

by:
Jeffrey Kane - TechSoEasy earned 2000 total points
ID: 19545816
Use the Exchange Troubleshooting Assistant.  It's a MUCH better method of analyzing the database and repairing it.  

Download:  http://www.microsoft.com/downloads/details.aspx?familyid=4bdc1d6b-de34-4f1c-aeba-fed1256caf9a

Tutorial:  http://www.msexchange.org/tutorials/Exchange-Troubleshooting-Assistant.html

Jeff
TechSoEasy
0
 

Author Comment

by:ipendlebury
ID: 19545878
Thanks for that. I've just run this tool. The only thing that looks suspicious on first glance is that it reports a DNS configuration issue: 'No 'Pointer' record(s) found for IP address 192.168.16.2'

I've just compared the DNS configuration with that of one of my other clients and I can't see any differences. So where should this pointer record go?

IAn
0
 
LVL 74

Expert Comment

by:Jeffrey Kane - TechSoEasy
ID: 19545940
Is there a reverse lookup zone for the domain?  It would be titled "192.168.16.x Subnet"

If there is that zone, is there a PTR record for the server itself?

If not, then you should open the Forward Lookup Zone and open the properties for 192.168.16.2's Host (A) record and tick the box that says to update the associated PTR record.

Jeff
TechSoEasy
0
 
LVL 74

Expert Comment

by:Jeffrey Kane - TechSoEasy
ID: 19545941
Just curious... if the tool said that, didn't it have a link for "how to fix"?

Jeff
TechSoEasy
0
 

Author Comment

by:ipendlebury
ID: 19545944
No, not for that one. I can see the link on other items though.

Ian
0
 
LVL 74

Expert Comment

by:Jeffrey Kane - TechSoEasy
ID: 19545946
Well, check out the info in the above comment then.

Jeff
TechSoEasy
0
 

Author Comment

by:ipendlebury
ID: 19545988
Sorry. I didn't notice that you'd posted twice in quick succession earlier.

I've put a pointer record in the Reverse Lookup Zone now. It hasn't changed anything though. I reran the CEICW for good measure, but to no avail.

Ian

0
 

Author Comment

by:ipendlebury
ID: 19546009
I've also got this warning:

The fully-qualified domain name of SMTP virtual server 'Default SMTP Virtual Server' on server gandalf does not match the DNS resolved server name. This may cause mail routing problems. SMTP virtual server: merlin-engineering.co.uk DNS resolved server name: gandalf.Merlin.local

Do  I need to resolve this?

Ian
0
 

Author Comment

by:ipendlebury
ID: 19546083
I've increased diagnostic logging for message routing. When I try to force connection now, I get an event like this logged for every message in the local delivery queue.

The following call : EcLocallyDeliverMsg to the store failed. Error Code: - 1601 (Message-ID <30736494.1185114782934@gretahouse.com>). MDB : aad94978-1c74-4050-a348-723ddc68bdb7. FID : . MID File : C:3ba5870c01c7cc510000000077.eml

Ian
0
 

Author Comment

by:ipendlebury
ID: 19546251
I've run isinteg.exe with the alltests switch. It didn't show any problems.

Ian
0
 
LVL 74

Expert Comment

by:Jeffrey Kane - TechSoEasy
ID: 19546313
Ideally, I'd like to review your complete DNS structure.  If you're interested in uploading that to www.ee-stuff.com referenced to this Question, that'd be great.  Just ping back here to advise me that it's uploaded.  The three reports that you need to export would be for "_msdcs.yourdomain.local" and "yourdomain.local" both found in the Forward Lookup Zone, then the "192.168.16.x Subnet" zone from the Reverse Lookups.

Then, you may want to run a few diag tests on the server such as SMTPDIAG.exe (http://www.msexchange.org/tutorials/SMTPDIAGdiagnose-Exchange-2003-SMTP-DNS.html

I'd also run NetDiag and DCDiag from the Windows Support Tools.

Jeff
TechSoEasy
0
 

Author Comment

by:ipendlebury
ID: 19546424
Hi Jeff,

I just combined those DNS reports into a single text file and uploaded it as requested. I'll take a look at your other suggestions now.

I still think that i'm dealing with some sort of corruption here, rather than a configuration issue. This all started when the server lost power unexpectedly.

Ian
0
 

Author Comment

by:ipendlebury
ID: 19546664
Hi Jeff,

SMTPDiag worked ok, as did NetDiag. DCDiag passed every test except SystemLog. This reported that it could not retrieve the EventString from 3 of todays events. I don't understand this. I can view these events normally.

Browsing the System Event Log, i've found another entry that would appear to be relevent:

Event ID: 10016

The application-specific permission settings do not grant Local Launch permission for the COM Server application with CLSID
{9DA0E106-86CE-11D1-8699-00C04FB98036}
 to the user NT AUTHORITY\SYSTEM SID (S-1-5-18).  This security permission can be modified using the Component Services administrative tool.

When I searched the registry for the CLSID above, it relates to something called the Microsoft Exchange Property mapping interface. I looked in Component Manager, but I cannot find it there.

Is this a red herring?

Ian
0
 

Author Comment

by:ipendlebury
ID: 19546822
I think the 10016 can probably be ignored. It only occured once, just as the server was rebooting.

Ian
0
 
LVL 74

Expert Comment

by:Jeffrey Kane - TechSoEasy
ID: 19550427
No, you shouldn't ignore it.  You should fix it:  http://www.smallbizserver.net/Articles/tabid/266/articleType/ArticleView/ArticleID/68/PageID/74/Default.aspx

But the overall problem is actually in your DNS, which I spotted last night from the report you sent.  There is a HOST (A) record for "publishing" pointing to your server's IP.  Delete this record and then I suggest that you run the Change Server IP Address wizard  (setting it to the same IP it already has) followed by the CEICW once again.

Jeff
TechSoEasy
0
 

Author Comment

by:ipendlebury
ID: 19551103
Hi Jeff,

Things have moved on somewhat now. I was under pressure to provide a resolution, and I figured you had gone to bed. So I called Microsoft Tech Support.

Firstly, he did the fix for the Dcom 10016 error and that is ok now.

After 3 hours, of not managing to unblock the Local Delivery Queue, he decided to replace it with a new queue continaing some dummy messages, and to put a new priv.edb in place. This worked. So he imported the messages from the old priv.edb and restored the original Local Delivery Queue. To migrate the messages, he used a tool called Exmerge which I thought was particularly useful. Everything is OK now. He was somewhat suprised that none of the diagnostics he performed indicated anything other than the oiginal priv.edb being perfectly healthy. So I felt somewhat vindicated for calling MS.

I would like to know more about the DNS issue you spotted. All 6 of the servers I administer have this entry. I have not put it there so it must have been created by the system. Two of the servers have had their IP address changed, the other four have been setup without a change of IP address.

I would like to thank you once again for the string of replies you supplied me with. As usual, they were very helpful. In particular I found the Exchange Troubleshooting Assistant quite useful. I am a programmer more than a server administrator. So my experience is often lacking.

Ian


0
 
LVL 74

Expert Comment

by:Jeffrey Kane - TechSoEasy
ID: 19551717
You can and should leave the DNS entry.  That's my mistake, so sorry about that.

Glad you got it working though.

Jeff
TechSoEasy
0

Featured Post

What does it mean to be "Always On"?

Is your cloud always on? With an Always On cloud you won't have to worry about downtime for maintenance or software application code updates, ensuring that your bottom line isn't affected.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

In the event you manage a Small Business Server 2003, and you are audited for PCI compliance, there are several changes you must make in order to pass the audit. I can take no credit for discovering any of these fixes or workarounds, but there is no…
I work for a company that primarily works with small businesses as their outsourced IT vendor. As such the majority of these customers utilize some version of Small Business Server. Due to the economics of running a small business, many of these cus…
Are you ready to place your question in front of subject-matter experts for more timely responses? With the release of Priority Question, Premium Members, Team Accounts and Qualified Experts can now identify the emergent level of their issue, signal…
Whether it be Exchange Server Crash Issues, Dirty Shutdown Errors or Failed to mount error, Stellar Phoenix Mailbox Exchange Recovery has always got your back. With the help of its easy to understand user interface and 3 simple steps recovery proced…
Suggested Courses
Course of the Month17 days, 7 hours left to enroll

864 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question