Microsoft KB Archive Search

Notice: This website is an unofficial Microsoft Knowledge Base (hereinafter KB) archive and is intended to provide a reliable access to deleted content from Microsoft KB. All KB articles are owned by Microsoft Corporation. Read full disclaimer for more details.

  1. Home
  2. Event 9874 is logged frequently after you install Exchange Server 2007 Service Pack 1

Event 9874 is logged frequently after you install Exchange Server 2007 Service Pack 1

View products that this article applies to.

Symptoms

After you install Microsoft Exchange Server 2007 Service Pack 1 on a computer that is running Exchange Server 2007, an event that resembles the following is logged frequently in the Application log:
Event ID : 9874 
Category: None 
Source: MSExchangeIS 
Type: Warning 
Message: 
Unexpected error 0x50a occurred in "EcProcessVirusScanQueueItem" during virus scanning. Mailbox Database: <LegacyExchangeDN of the mailbox store> Folder ID: <folder ID> Message ID: <message ID>.
This problem may also affect server performance if the server is operating under a heavy workload. A heavy workload is a situation in which there are too many threads or a situation in which the CPU usage is much higher than expected.

↑ Back to the top

Cause

Exchange Server 2007 Service Pack 1 introduces event 9874 to help with troubleshooting. When Virus Scan API (VSAPI) reports an issue at any diagnostic logging level, this event is logged so that users can trace the reason why an embedded message has a different signature than the top-level message. However, this event may also be logged when two threads try to obtain the same message.

↑ Back to the top

Resolution

To resolve this problem, install Update Rollup 7 for Exchange 2007 Service Pack 1. For more information about how to obtain this update, see the following Microsoft Knowledge Base article:
960384 Description of Update Rollup 7 for Exchange Server 2007 Service Pack 1

Note After you install this update, Exchange Server 2007 logs Event 9874 only when the diagnostic logging level of the MSExchangeIS\9002 System\Virus Scanning process is set to "high" or to "expert." Therefore, you stop receiving the unnecessary warnings and still receive all the necessary warnings.

↑ Back to the top

Status

Microsoft has confirmed that this is a problem in the Microsoft products that are listed in the "Applies to" section.

↑ Back to the top

Keywords: KB967081, kbexpertiseinter, atdownload, kbqfe, kbsurveynew

↑ Back to the top

Article Info
Article ID : 967081
Revision : 3
Created on : 9/7/2009
Published on : 9/7/2009
Exists online : False
Views : 317