Microsoft KB Archive Search

Notice: This website is an unofficial Microsoft Knowledge Base (hereinafter KB) archive and is intended to provide a reliable access to deleted content from Microsoft KB. All KB articles are owned by Microsoft Corporation. Read full disclaimer for more details.

  1. Home
  2. XADM: MSExchangeISPriv Event ID 2011 Causes Information Store To Stop

XADM: MSExchangeISPriv Event ID 2011 Causes Information Store To Stop

View products that this article applies to.

This article was previously published under Q184438

↑ Back to the top

Symptoms

You may see the following event in the Application event log: 
   Event ID: 2011
   Type:     Error
   Source:   MSExchangeISPriv
   Category: Transport
   Description:  Error 0x80040115 occurred while writing delivery log
   information to the Microsoft Exchange System Attendant.

You may also notice the following event in the Application event log: 
   Event ID: 5007
   Type:     Warning
   Source:   MSExchangeSA
   Category: General
   Description:  An error occurred during the message tracking decode
   operation.

The effect of the first event (2011) is that the information store stops. Upon further investigation, you may notice that all Exchange services are hung. The System Attendant may appear to be started, but it will fail to stop with the following error:
Could not stop the Microsoft Exchange System Attendant on SERVER1.
Error 2186: The service is not responding to the control function.
These events can occur on any computer running Exchange Server 4.0, even with Service Pack 1, Service Pack 2, Service Pack 3, or Service Pack 4 installed.

↑ Back to the top

Cause

The computer running Exchange Server is missing a file necessary for decoding message tracking information from the Message Transfer Agent (MTA).

See 161935� "XADM: Message Tracking Error 5007 Caused by Missing *.Arc Files"for more details.

The Exchsrvr\Tracking.log directory may be filled with thousands of ASNxxxx.tmp files, and the Acse.arc file may be missing from the Exchsrvr\Bin directory of the Exchange Server computer. This undoubtedly is the cause of the Event 5007 errors.

The Event 2011 errors are most likely caused by invalid data being written to the message tracking log. This data, when parsed, causes the System Attendant to hang, which halts all other Exchange Server services, including the information store, which is the actual source of the error.

↑ Back to the top

Workaround

This problem can be resolved by copying a valid Acse.arc from another computer running Exchange Server 4.0.

See 161935� "XADM: Message Tracking Error 5007 Caused by Missing *.Arc Files" for details on valid file sizes and dates for *.arc files.

After copying this file, the Exchange Server services will all need to be restarted.

↑ Back to the top

More information

If this does not eliminate the problem, disable Message Tracking on the affected Exchange Server computer by following the instructions in the following Microsoft Knowledge Base article:
148963� XADM: Disabling Message Tracking For One or More Servers
This will disable Message Tracking for this server only, as opposed to disabling Message Tracking for the entire site in the Exchange Server Administrator program.

↑ Back to the top

Keywords: KB184438, kbprb

↑ Back to the top

Article Info
Article ID : 184438
Revision : 6
Created on : 10/28/2006
Published on : 10/28/2006
Exists online : False
Views : 324