Start Free Trial

asked on

MSExchange Common Event 4999 e2k7

I've been getting these events at regular intervals, and I'm having a hard time finding anything on them in my searches. I read at one place that it's possibly related to a proxy server, and port 80 was being proxied, but I removed it from that proxy and I still get these events. I also read that these show up on versions of e2k7 prior to rollup 6 on SP1, but I installed SP2 and they're still showing. Anything else I should look into?

Event Type:      Error
Event Source:      MSExchange Common
Event Category:      General
Event ID:      4999
Date:            2/5/2010
Time:            9:41:53 AM
User:            N/A
Computer:      MAIL2007
Description:
Watson report about to be sent to dw20.exe for process id: 2168, with parameters: E12IIS, c-RTL-AMD64, 08.02.0176.002, WS, M.E.Services, M.E.S.C.T.SingleProxyDeterministicCASBoxScoring.GetSiteGuidForServer, System.NullReferenceException, ff95, 08.02.0217.000. ErrorReportingEnabled: False

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Shivkumar Sharma

Refer Microsoft Kb articles below

944752, 945938, 947360, 948666, 949463, and 956532

ASKER

All of those seem to point to issues that were fixed with SP1 rollups. I have SP2 installed. Is there anything after SP2 that I should install as an update?

Shivkumar Sharma

Please install Update Rollup 2 for Microsoft Exchange server 2007 SP2 and let us know if you still facing the issue

ASKER

I installed the rollup last night. I'm still getting the events this morning.

Shivkumar Sharma

Do you see any more waring/error events just before or after this event, if any. Please paste it here, also is it causing any service to carsh or exchange box to be partially down?

ASKER

No other warnings or errors in the immediate vicinity. It doesn't seem to be causing problems for any services yet, but there are only 20 mailboxes so far. There will be about 60 once I've migrated the rest over. I'm afraid it might cause performance issues down the road once everyone is moved.

ASKER

These informational events surround the 4999 events. The process varies, but it's always related to a discovery of servers in AD:

Event Type: Information
Event Source: MSExchange ADAccess
Event Category: Topology
Event ID: 2080
Date: 2/9/2010
Time: 4:48:19 AM
User: N/A
Computer: MAIL2007
Description:
Process STORE.EXE (PID=1748). Exchange Active Directory Provider has discovered the following servers with the following characteristics:
(Server name | Roles | Enabled | Reachability | Synchronized | GC capable | PDC | SACL right | Critical Data | Netlogon | OS Version)
In-site:
DC1.hq.domain.com CDG 1 7 7 2 0 1 1 7 1
DC2.hq.domain.com CD- 1 5 6 0 0 1 1 6 0
Out-of-site:

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Shivkumar Sharma

Just add a clumn in task manager -> Processess->View->Select Coulmns->PID and please update us as to which process the PID is corresponding to in the event 4999

ASKER

w3wp.exe

Shivkumar Sharma

Thats an IIS related Process

Make sure you have the latest Service pack and patches on windows installed on your server

ASKER

I have the latest updates as far as I know. At least there are no more updates available when I run microsoft update and select express updates. Is there anything I should verify beyond that?

Shivkumar Sharma

Install the update available in the below article ( It will update the w3wp.exe to 6.0.3790.3959) and update us

http://support.microsoft.com/kb/973917

ASKER

What about this:

http://support.microsoft.com/kb/2009746/

I think I used a SP1 directory when I installed SP2 the first time. I see a few files listed as prerequisites that are version 6.0.3790.1830. If I install SP2 again and update those files, are those the conditions this article is talking about?

Shivkumar Sharma

You may ahead with it but just remember that It may be necessary to disable the Scalable Networking Pack after re-applying Service Pack 2 to address the issues described in KB 948496

ASKER

How do I avoid installing SP2 incorrectly again if all I have to reference are the SP1 binaries? I don't quite understand how this could have happened in the first place. Is there somewhere I can download the proper SP2 binaries? I have the Service Pack downloaded and the hotfix provided in http://support.microsoft.com/kb/948496, but I'm not sure that if I install the SP that I will be installing all of the proper dll files.

ASKER

I just tried installing SP2 again on the Server 2003 x64. I still see that the files listed above are not the right version.

Shivkumar Sharma

When you say files listed above are not the right version, are you referring to the w3wp.exe file and the related files?

ASKER

I've attached three screenshots of what I'm reading that is making me think that I have the wrong versions of files. w3wp.exe you'll see is one of them. Like I said in an earlier post, most of them are of the proper version, but there are some that are not late enough, and I'm stuck as to how to get them to be proper.

Screen-shot-2010-02-16-at-9.12.2.png
Screen-shot-2010-02-16-at-9.12.4.png
Screen-shot-2010-02-16-at-9.12.5.png

Shivkumar Sharma

I know thats the reason why we want to get the latest version w3wp.exe installed on your machine and then observe it. So you mean to say even after installing the update mentioned in the KB article it does not upgrade the W3wp.exe file to the version mentioned in the Kb-Article.

I shall be unavailbale after now but shall revert back to you

ASKER

I'm under the impression that the files listed in the screenshot are supposed to be version 6.0.3790.3959 *before* I apply the update in the KB you suggest to apply to get rid of the 4999 events. On that first screenshot, it says that the update should not be applied until a correct installation of SP2 has been verified. The table following on the screenshot lists the files that should be verified, and the version that they should be greater than or equal to. When I look at these files on the 2003 Server, there are some that are of a version earlier than the KB requires. I've attached a couple more screenshots illustrating where I'm seeing that these file's versions don't match.

Screen-shot-2010-02-16-at-11.42..png
Screen-shot-2010-02-16-at-11.43..png

ASKER

I looked at a couple of other x64 versions of Windows 2003 Servers we have here and noticed that they also have the same versions of those files. Am I completely misreading this KB?

ASKER

I decided also to take a look at a Server 2003 SP2 32 bit system, and I can see the files there are of the proper version. Does this have something to do with the 64 bit system?

ASKER

I look at both the C:\WINDOWS\system32\inetsrv and C:\WINDOWS\sysWOW64\inetsrv dll's on the e2k7 64 bit server and they are both not of the proper version. This must have something to do with the 64 bit version of SP2.

Shivkumar Sharma

Strange, I was looking for any other possible update release by microsoft for 64 bit systems but I couldnt find any

ASKER

So what should I make of these events? I've been waiting to complete the migration from our 2003 Exchange because of this. Since e2k7 has to be installed on a 64bit system, I would think that this would be a common event on everyone's server and would have been dealt with by now. I feel like there has to be something causing these events and I'm a little leery of putting my complete trust in this installation. Thank you for being so helpful by the way.

Shivkumar Sharma

Thanks you are welcome, Please give me some time and lets see if we can get a go through

ASKER CERTIFIED SOLUTION

Shivkumar Sharma

membership

This solution is only available to members.

To access this solution, you must be a member of Experts Exchange.

Start Free Trial

ASKER

I feel like I'm getting this event because there was something I forgot to do. Wouldn't this be an event that everyone would get in that case? I understand that it says in the name of the event that it's common, but no one has told me that this happens to everyone. I see a red X and an error reported and it makes me wonder about the stability of my server. Could you tell me what all the w3wp.exe file affects so I can be on the lookout for anything telling? I know that it's part of the web services provided by Exchange, but does it also affect MAPI traffic or any of the other protocols for email? I appreciate your help.

ASKER

Looks like this event stopped loggin around the 25th of February. I can't say I did anything directly on that day that would have caused these events to stop.

Shivkumar Sharma

Great! Even I would have loved to know. It affects the IIS as a whole so consequences could depend!

ASKER

Looks like I spoke too soon with that last comment. I just saw one of those events show up. It happened yesterday around 10:00am. I don't really see anything surrounding it that would give me any more clues. That was the first one for a few days though. I wonder what is causing it.

Shivkumar Sharma

I think as of now we can just wait till the new hotfix is released which has this fixed if it is reported to
Micorsoft

ASKER

Has it been reported to Microsoft? Do you have any idea of what it might be that they would have to fix?

Shivkumar Sharma

We cannot tell if it has reported to Microsoft yet or not, unless someone contacts microsoft for the same issue and then they take a note of it is as a bug, only then the hotfix gets released. As of now since no latest update of w3wp.exe file except the one which we discussed earlier can be found, We will have to wait till its latest update release , if you wish to fix it as a pripority then contacting Micrsooft support through Phone would be the only option.

Whats up now? I have the same Problem with Exchnage 2007 SP3 Rollup 3 on sbs 2008.