wasabikev
asked on
Trying to understand Event ID 1000 error for Exchange server
I'm tyring to figure out what this error is referring to -and more importantly- how to resolve it if it is a serious issue.
It has happened only once (last night). Everything is online at this point... but I'd like to know what this is regarding so I can ascertain how much I should worry.
(Exchange 2003 w SP2 on Server 2003)
Event Type: Error
Event Source: Microsoft Exchange Server
Event Category: None
Event ID: 1000
Date: 2/11/2008
Time: 2:00:40 AM
User: N/A
Computer: CYGNUS
Description:
Faulting application exsp.dll, version 6.5.7638.1, stamp 430e735b, faulting module mimefilt.dll, version 6.0.3790.1830, stamp 424377cc, debug? 0, fault address 0x00002a21.
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 41 00 70 00 70 00 6c 00 A.p.p.l.
0008: 69 00 63 00 61 00 74 00 i.c.a.t.
0010: 69 00 6f 00 6e 00 20 00 i.o.n. .
0018: 46 00 61 00 69 00 6c 00 F.a.i.l.
0020: 75 00 72 00 65 00 20 00 u.r.e. .
0028: 20 00 65 00 78 00 73 00 .e.x.s.
0030: 70 00 2e 00 64 00 6c 00 p...d.l.
0038: 6c 00 20 00 36 00 2e 00 l. .6...
0040: 35 00 2e 00 37 00 36 00 5...7.6.
0048: 33 00 38 00 2e 00 31 00 3.8...1.
0050: 20 00 34 00 33 00 30 00 .4.3.0.
0058: 65 00 37 00 33 00 35 00 e.7.3.5.
0060: 62 00 20 00 69 00 6e 00 b. .i.n.
0068: 20 00 6d 00 69 00 6d 00 .m.i.m.
0070: 65 00 66 00 69 00 6c 00 e.f.i.l.
0078: 74 00 2e 00 64 00 6c 00 t...d.l.
0080: 6c 00 20 00 36 00 2e 00 l. .6...
0088: 30 00 2e 00 33 00 37 00 0...3.7.
0090: 39 00 30 00 2e 00 31 00 9.0...1.
0098: 38 00 33 00 30 00 20 00 8.3.0. .
00a0: 34 00 32 00 34 00 33 00 4.2.4.3.
00a8: 37 00 37 00 63 00 63 00 7.7.c.c.
00b0: 20 00 66 00 44 00 65 00 .f.D.e.
00b8: 62 00 75 00 67 00 20 00 b.u.g. .
00c0: 30 00 20 00 61 00 74 00 0. .a.t.
00c8: 20 00 6f 00 66 00 66 00 .o.f.f.
00d0: 73 00 65 00 74 00 20 00 s.e.t. .
00d8: 30 00 30 00 30 00 30 00 0.0.0.0.
00e0: 32 00 61 00 32 00 31 00 2.a.2.1.
00e8: 0d 00 0a 00 ....
It has happened only once (last night). Everything is online at this point... but I'd like to know what this is regarding so I can ascertain how much I should worry.
(Exchange 2003 w SP2 on Server 2003)
Event Type: Error
Event Source: Microsoft Exchange Server
Event Category: None
Event ID: 1000
Date: 2/11/2008
Time: 2:00:40 AM
User: N/A
Computer: CYGNUS
Description:
Faulting application exsp.dll, version 6.5.7638.1, stamp 430e735b, faulting module mimefilt.dll, version 6.0.3790.1830, stamp 424377cc, debug? 0, fault address 0x00002a21.
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 41 00 70 00 70 00 6c 00 A.p.p.l.
0008: 69 00 63 00 61 00 74 00 i.c.a.t.
0010: 69 00 6f 00 6e 00 20 00 i.o.n. .
0018: 46 00 61 00 69 00 6c 00 F.a.i.l.
0020: 75 00 72 00 65 00 20 00 u.r.e. .
0028: 20 00 65 00 78 00 73 00 .e.x.s.
0030: 70 00 2e 00 64 00 6c 00 p...d.l.
0038: 6c 00 20 00 36 00 2e 00 l. .6...
0040: 35 00 2e 00 37 00 36 00 5...7.6.
0048: 33 00 38 00 2e 00 31 00 3.8...1.
0050: 20 00 34 00 33 00 30 00 .4.3.0.
0058: 65 00 37 00 33 00 35 00 e.7.3.5.
0060: 62 00 20 00 69 00 6e 00 b. .i.n.
0068: 20 00 6d 00 69 00 6d 00 .m.i.m.
0070: 65 00 66 00 69 00 6c 00 e.f.i.l.
0078: 74 00 2e 00 64 00 6c 00 t...d.l.
0080: 6c 00 20 00 36 00 2e 00 l. .6...
0088: 30 00 2e 00 33 00 37 00 0...3.7.
0090: 39 00 30 00 2e 00 31 00 9.0...1.
0098: 38 00 33 00 30 00 20 00 8.3.0. .
00a0: 34 00 32 00 34 00 33 00 4.2.4.3.
00a8: 37 00 37 00 63 00 63 00 7.7.c.c.
00b0: 20 00 66 00 44 00 65 00 .f.D.e.
00b8: 62 00 75 00 67 00 20 00 b.u.g. .
00c0: 30 00 20 00 61 00 74 00 0. .a.t.
00c8: 20 00 6f 00 66 00 66 00 .o.f.f.
00d0: 73 00 65 00 74 00 20 00 s.e.t. .
00d8: 30 00 30 00 30 00 30 00 0.0.0.0.
00e0: 32 00 61 00 32 00 31 00 2.a.2.1.
00e8: 0d 00 0a 00 ....
ASKER
That's... really interesting on several fronts.
A malformed email or other item sent through the Exchange Information Store can cause the entire service to crash? That's really not good news if true. Is the malform a randomized corruption, or is it by design? And if it can happen via random circumstances, are those circumstances easily reproduceable? In which case it could be done via design... (ugh). I'm not an uber-Exchange admin, but methinks you've just indicated a potential exploit....
Your input is deeply interesting whlie being quite disconcering at the same time. Given the ramifications, I would greatly appriciate sources for additional study and verification of this hypothesis. (KB article or other?) Thanks for you time.
A malformed email or other item sent through the Exchange Information Store can cause the entire service to crash? That's really not good news if true. Is the malform a randomized corruption, or is it by design? And if it can happen via random circumstances, are those circumstances easily reproduceable? In which case it could be done via design... (ugh). I'm not an uber-Exchange admin, but methinks you've just indicated a potential exploit....
Your input is deeply interesting whlie being quite disconcering at the same time. Given the ramifications, I would greatly appriciate sources for additional study and verification of this hypothesis. (KB article or other?) Thanks for you time.
Did you enable Full Text Indexing on the exchange server? I did not get the exact kb for this error, but still check for the following which may help to get some knowledge.
http://support.microsoft.com/default.aspx?scid=kb;en-us;827214
http://forums.techarena.in/showthread.php?t=833975
As the exsp.dll is an exchange component, I think re-applying Exchange SP2 on the server should resolve the issue.
http://support.microsoft.com/default.aspx?scid=kb;en-us;827214
http://forums.techarena.in/showthread.php?t=833975
As the exsp.dll is an exchange component, I think re-applying Exchange SP2 on the server should resolve the issue.
ASKER
Full Text Indexting is not enabled on the server.
However, a few clients do have Desktop Search installed.
I had previously found references to the same type of error
"Faulting application exsp.dll, version 6.5.7638.1, stamp 430e735b,
faulting module offfilt.dll, version 2002.10.4.0"
This is close... but the issue here involves mimefilt.dll, not Offfilt.dll. That said, I have also found this KB: http://support.microsoft.com/kb/915800 which indicates an issue and hotflx related to Offffilt.dll and Mimefilt.dll. Alas- the versions of the files indicated in this KB article do not quite match.
Overall it looks like this may be related to Desktop Search. This issue has not reoccured since the original post, but Desktop Search will get installed on more systems soon. If it is related to the clients getting desktop search installed, I'll know it soon enough.
However, a few clients do have Desktop Search installed.
I had previously found references to the same type of error
"Faulting application exsp.dll, version 6.5.7638.1, stamp 430e735b,
faulting module offfilt.dll, version 2002.10.4.0"
This is close... but the issue here involves mimefilt.dll, not Offfilt.dll. That said, I have also found this KB: http://support.microsoft.com/kb/915800 which indicates an issue and hotflx related to Offffilt.dll and Mimefilt.dll. Alas- the versions of the files indicated in this KB article do not quite match.
Overall it looks like this may be related to Desktop Search. This issue has not reoccured since the original post, but Desktop Search will get installed on more systems soon. If it is related to the clients getting desktop search installed, I'll know it soon enough.
ASKER CERTIFIED SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
CAUSE:
This problem may occur when there is a malformed e-mail message or other malformed item in the information store. Additionally, the processing of parameters in a HTML close tag may cause the Microsoft Exchange Information Store service to crash.
RESOLUTION:
A supported hotfix is now available from Microsoft, but it is only intended to correct the problem. Only apply it to systems that are experiencing this specific problem. You must stop and then restart the Microsoft Exchange Information Store service when you install this hotfix. You should install the hotfix on the front-end servers first, and then install the hotfix on the back-end servers.
But according to my suggestion do not install the hotfix if it is not causing serious problem. Better update your exchange server to the latest windows service pack available.