• Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 2440
  • Last Modified:

Exchange 2007 Information Store and Service Attendant shutting down

We have a single homed Exchange 2007 server with all roles installed.  Over the past two weeks the Information Store service and Service Attendant service have been shutting down in the middle of the night.  I've noticed at about the same time the follow errors (the errors are sequential).  Any suggestions? Memory issues?  I have plenty of available disk space.  The server has 2gigs of physical memory and the page file is set to 4 gig min - 6 gig max.

Event Type:	Information
Event Source:	MSExchange ADAccess
Event Category:	Topology 
Event ID:	2080
Date:		4/3/2009
Time:		3:13:09 AM
User:		N/A
Computer:	"servername"
Description:
Process STORE.EXE (PID=3912). Exchange Active Directory Provider has discovered the following servers with the following characteristics: 
 (Server name | Roles | Enabled | Reachability | Synchronized | GC capable | PDC | SACL right | Critical Data | Netlogon | OS Version) 
In-site:
adserver1.domain.com	CDG 1 7 7 1 0 1 1 0 1
adserver2.domain.com	CDG 1 7 7 1 0 1 1 0 1
 Out-of-site:
 For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
 
Event Type:	Error
Event Source:	MSExchange ADAccess
Event Category:	Topology 
Event ID:	2114
Date:		4/3/2009
Time:		3:13:09 AM
User:		N/A
Computer:	"servername"
Description:
Process STORE.EXE (PID=3912). Topology discovery failed, error 0x80040a02 (DSC_E_NO_SUITABLE_CDC). Look up the Lightweight Directory Access Protocol (LDAP) error code specified in the event description. To do this, use Microsoft Knowledge Base article 218185, "Microsoft LDAP Error Codes." Use the information in that article to learn more about the cause and resolution to this error. Use the Ping or PathPing command-line tools to test network connectivity to local domain controllers.
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
 
Event Type:	Error
Event Source:	MSExchangeFBPublish
Event Category:	General 
Event ID:	8207
Date:		4/3/2009
Time:		3:17:51 AM
User:		N/A
Computer:	"servername"
Description:
Error updating public folder with free/busy information on virtual machine "servername". The error number is 0x80004005.
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
 
Event Type:	Error
Event Source:	MSExchangeSA
Event Category:	General 
Event ID:	9385
Date:		4/3/2009
Time:		3:20:53 AM
User:		N/A
Computer:	"servername"
Description:
Microsoft Exchange System Attendant failed to read the membership of the universal security group '/dc=com/dc="domain"/ou=Microsoft Exchange Security Groups/cn=Exchange Servers'; the error code was '8007203a'. The problem might be that the Microsoft Exchange System Attendant does not have permission to read the membership of the group. 
 
If this computer is not a member of the group '/dc=com/dc="domain"/ou=Microsoft Exchange Security Groups/cn=Exchange Servers', you should manually stop all Microsoft Exchange services, run the task 'add-ExchangeServerGroupMember,' and then restart all Microsoft Exchange services. 
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
 
Event Type:	Error
Event Source:	MSExchange Common
Event Category:	General 
Event ID:	4999
Date:		4/3/2009
Time:		3:23:55 AM
User:		N/A
Computer:	"servername"
Description:
Watson report about to be sent to dw20.exe for process id: 4760, with parameters: E12N, c-rtl-AMD64, 08.00.0813.000, mad.exe, RPCRT4.dll, 8475f, c0000005, 6777, 5.2.3790.4115 (srv03_sp2_gdr.070709-2335)
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
 
Event Type:	Information
Event Source:	MSExchange ADAccess
Event Category:	Topology 
Event ID:	2080
Date:		4/3/2009
Time:		3:28:09 AM
User:		N/A
Computer:	"servername"
Description:
Process STORE.EXE (PID=3912). Exchange Active Directory Provider has discovered the following servers with the following characteristics: 
 (Server name | Roles | Enabled | Reachability | Synchronized | GC capable | PDC | SACL right | Critical Data | Netlogon | OS Version) 
In-site:
adserver1.domain.com	CDG 1 7 7 1 0 1 1 7 1
adserver2.domain.com	CDG 1 7 7 1 0 1 1 7 1
 Out-of-site:
 For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
 
Event Type:	Error
Event Source:	.NET Runtime
Event Category:	None
Event ID:	0
Date:		4/3/2009
Time:		3:29:22 AM
User:		N/A
Computer:	"servername"
Description:
The description for Event ID ( 0 ) in Source ( .NET Runtime ) cannot be found. The local computer may not have the necessary registry information or message DLL files to display messages from a remote computer. You may be able to use the /AUXSOURCE= flag to retrieve this description; see Help and Support for details. The following information is part of the event: .NET Runtime version : 2.0.50727.1433 - Application ErrorApplication has generated an exception that could not be handled.
Process ID=0x1448 (5192), Thread ID=0xfd8 (4056).
Click OK to terminate the application.
Click CANCEL to debug the application..
 
Event Type:	Error
Event Source:	MSExchangeIS
Event Category:	General 
Event ID:	9673
Date:		4/3/2009
Time:		3:38:55 AM
User:		N/A
Computer:	"servername"
Description:
An exception with code 0xc00000fd was thrown in module ; some parameters and their values were <Exception address - af54a7>. A significant section of the call stack is in the data section. 
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
00000: a0 90 81 34 00 00 00 00    4....
00008: ea a5 9e 00 00 00 00 00   ꥞.....
00010: 9b 3d a1 00 00 00 00 00   ›=¡.....
00018: 00 00 00 00 00 00 00 00   ........
00020: 00 00 00 00 00 00 00 00   ........
00028: 09 00 00 00 00 00 00 00   ........
00030: 04 00 00 00 00 00 00 00   ........
00038: fb 7f 00 00 00 00 00 00   û......
00040: 40 72 b8 00 00 00 00 00   @r¸.....
00048: 00 00 00 00 00 00 00 00   ........
There were too many of these addresses to list here
10000: 5b 44 49 41 47 5f 43 54   [DIAG_CT
10008: 58 5d 00 00 16 00 00 00   X]......
10010: ff f0 05 00 00 00 00 00   ÿð......
10018: 00 02 08 00 00 00 3a 67   ......:g
10020: f0 1f fe 00 00 00         ð.þ...  
 
Event Type:	Error
Event Source:	MSExchangeIS
Event Category:	General 
Event ID:	9659
Date:		4/3/2009
Time:		3:38:55 AM
User:		N/A
Computer:	"servername"
Description:
The Microsoft Exchange Information Store encountered an unexpected exception 0xC00000FD at address 0000000000AF54A7 while processing a request for user "username". 
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 45 00 63 00 44 00 6f 00   E.c.D.o.
0008: 52 00 70 00 63 00 45 00   R.p.c.E.
0010: 78 00 74 00 32 00 00 00   x.t.2...
0018: 5b 44 49 41 47 5f 43 54   [DIAG_CT
0020: 58 5d 00 00 16 00 00 00   X]......
0028: ff f0 05 00 00 00 00 00   ÿð......
0030: 00 02 08 00 00 00 3a 67   ......:g
0038: f0 1f fe 00 00 00         ð.þ...

Open in new window

0
taltomare
Asked:
taltomare
  • 5
  • 3
  • 2
1 Solution
 
zelron22Commented:
Have you checked this out from the log?

 
If this computer is not a member of the group '/dc=com/dc="domain"/ou=Microsoft Exchange Security Groups/cn=Exchange Servers', you should manually stop all Microsoft Exchange services, run the task 'add-ExchangeServerGroupMember,' and then restart all Microsoft Exchange services.
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
 
If this isn't it, what changed when this started?  Was the server account moved to another OU?  Is DNS set correctly?

Check out this thread.

http://www.experts-exchange.com/Software/Server_Software/Email_Servers/Exchange/Q_23048451.html
0
 
taltomareAuthor Commented:
What "log" are you referring to?  This server has been running in this domain for about a year.  Is there a way I can check the membership of the server in group?  I've checked all of our documented info about the server and nothing has changed in the past month.  We were going to run the SP1 update this week but since we're having these problems I was holding off from doing this.  DNS is functioning for everything else and nothing has change there.  I'll check the event logs on the DNS server to make sure everything is ok with that.
0
 
taltomareAuthor Commented:
Another note to point out is that the exchange server does communicate properly with the AD servers.  Check the first event id in the list and you'll see what I'm talking about.
0
The new generation of project management tools

With monday.com’s project management tool, you can see what everyone on your team is working in a single glance. Its intuitive dashboards are customizable, so you can create systems that work for you.

 
zelron22Commented:
The log I was referring to was the one you posted, and I quoted from it below.

You check the membership by opening up the computer account in AD Users and Computers and look at the Member Of tab.

Is the DNS set up properly on the Exchange server TCP/IP settings?  It should be pointing to (and ONLY to) an AD aware DNS server, generally a domain controller.

0
 
taltomareAuthor Commented:
The DNS on the Exchange server should not be pointing directly to the internal DNS server but to an AD server that is pointed to the DNS server?
0
 
zelron22Commented:
There's two kinds of DNS in the Windows world.  Active Directory aware DNS, and everything else.

I don't know what you mean by "internal DNS server", but if it is NOT an Active Directory aware DNS server, then your Exchange server should not point to it at all.  It should point to an AD DNS server, and then the AD DNS server should be set to forward to the other DNS server, if needed.  

If that doesn't make sense, perhaps you could tell me more about your DNS set up.
0
 
taltomareAuthor Commented:
Ok, Yes our internal DNS server is an Active Directory DNS server.  
0
 
MesthaCommented:
It looks like your server is struggling to see the domain controllers correctly. That causes all the other errors. Therefore I would be looking at that as the cause of the problem - networking for example.

Simon.
0
 
taltomareAuthor Commented:
I tested / certified all the cabling involved and changed the port on the network switch that the server is plugged into.  Everything seems to be working in that area.  I even updated the network driver.  Anything else you think I should do to rule out the network connections?
0
 
MesthaCommented:
It doesn't have to be network connections to that server, it could be the domain controller. Exchange hooks on to a specific DC and doesn't go looking for another DC for 35 minutes if that DC is not available. If you only have one DC that is a GC then Exchange wouldn't have any others to choose from.

Simon.
0

Featured Post

Free Tool: SSL Checker

Scans your site and returns information about your SSL implementation and certificate. Helpful for debugging and validating your SSL configuration.

One of a set of tools we are providing to everyone as a way of saying thank you for being a part of the community.

  • 5
  • 3
  • 2
Tackle projects and never again get stuck behind a technical roadblock.
Join Now