Event ID 3028 MSExchangeApplicationLogic

Hi,

I have a problem where Event ID 3028 Source MSExchangeApplicationLogic is beeing logged every 6 hours with 4 same type of events. Here is the log:

Scenario: ProcessKillBit. Failed to read killbit list file because of exception System.IO.IOException: The process cannot access the file 'C:\Program Files\Microsoft\Exchange Server\V15\ClientAccess\owa\prem\15.0.995.29\ext\killbit\killbit.xml' because it is being used by another process.
   at System.IO.__Error.WinIOError(Int32 errorCode, String maybeFullPath)
   at System.IO.FileStream.Init(String path, FileMode mode, FileAccess access, Int32 rights, Boolean useRights, FileShare share, Int32 bufferSize, FileOptions options, SECURITY_ATTRIBUTES secAttrs, String msgPath, Boolean bFromProxy, Boolean useLongPath, Boolean checkHost)
   at System.IO.FileStream..ctor(String path, FileMode mode, FileAccess access, FileShare share, Int32 bufferSize, FileOptions options, String msgPath, Boolean bFromProxy)
   at System.IO.FileStream..ctor(String path, FileMode mode, FileAccess access, FileShare share)
   at System.IO.File.Open(String path, FileMode mode, FileAccess access, FileShare share)
   at Microsoft.Exchange.Data.ApplicationLogic.Extension.KillBitHelper.TryReadKillBitFile(Int32& refreshRate, DateTime& lastModifiedTime)

The environment is single virtual MS Exchange 2013 server running on Windows 2012 R2. DC is running on a separate server.

I can't seem to find any articles or blogs relating to this issue.

Thanks for any help.

November 3rd, 2014 12:16pm

What cumulative update is installed?
Free Windows Admin Tool Kit Click here and download it now
November 3rd, 2014 8:42pm

Hi,

Please delete the file killbit.xml and then perform IIS reset to check result.

Here is a related thread for your reference.

https://social.technet.microsoft.com/Forums/en-US/feff98cb-5b48-4537-b86b-8dcf41cb9992/event-id-3028-msexchangeapplcationlogic

Hope this is helpful to you.

Best regards,

November 4th, 2014 8:15am

Thank you for your reply.

The Exchange is 15.0.995.29 which is CU6

Free Windows Admin Tool Kit Click here and download it now
November 4th, 2014 6:03pm

I tried to delete the killbit.xml file and reset the IIS. First no event was recorded and I thought that the issue has been solved but unfortunately the event was logged again with re-occurrence after 12 hours this time instead of every 6 hours as it was earlier and is now.
November 6th, 2014 12:19pm

Hi,

Please run handle.exe on killbit.xml and check if there is any process using it.

And please check if there is Antivirus scan running. If there is, please disable it temporarily to check result.

Best regards,

Free Windows Admin Tool Kit Click here and download it now
November 10th, 2014 5:07am

Hello, same problem here.

Fresh install of Win 2012 R2 + Exchange 2013 SP1 updated to CU7 in the VM, no antivirus.

I've got six times per day ID 3028 Warning

Scenario: ProcessKillBit. Failed to read killbit list file because of exception System.IO.IOException: The process cannot access the file 'C:\Program Files\Microsoft\Exchange Server\V15\ClientAccess\owa\prem\15.0.1044.25\ext\killbit\killbit.xml' because it is being used by another process.

I have already tried to delete killbit.xml and restart IIS but the problem persists.

Handle.exe doesn't show anything.

Do you have any suggestion?

Regards,
M.

December 22nd, 2014 11:19am

I also see this about 6 to 8 times a day.  Also a fresh install of EX2013 CU7. No AV.
Free Windows Admin Tool Kit Click here and download it now
January 2nd, 2015 9:05pm

Exactly the same problem here (fresh install EX2013 CU7, no AV)

Anyone found a solution meanwhile?

February 23rd, 2015 4:50am

Same issue, new install Ex2013 CU6 no AV on VM.
Every 6 hours

Free Windows Admin Tool Kit Click here and download it now
February 28th, 2015 9:22pm

Same issue, new install Ex2013 CU6 no AV on VM.
Every 6 hours

February 28th, 2015 9:22pm

@Belinda Ma: Why did you tag this as answer? As you might see, this thread is far away from being answered!

I kindly ask you to remove that tagging.

Free Windows Admin Tool Kit Click here and download it now
February 28th, 2015 9:49pm

Hi all,

Any update about this KillBit issue ?

I have the same issue also after upgrading to CU7 of Exchange 2013.

Thx,

Michal

March 13th, 2015 7:15am

Did not help
Free Windows Admin Tool Kit Click here and download it now
March 13th, 2015 7:47am

Have done that
March 13th, 2015 7:48am

Same issue here.  Fresh install CU7 no AV.
Free Windows Admin Tool Kit Click here and download it now
March 13th, 2015 4:34pm

Same thing for me on CU7. 
March 23rd, 2015 12:44pm

Same problem. Fresh install of Exchange 2013 on Windows 2008 R2 SP1. All updates and pre-req performed correctly and in order. CU7 appli
Free Windows Admin Tool Kit Click here and download it now
March 27th, 2015 8:37am

Same issue here Exchange 2013 CU8. The error only occurs on mailbox servers, the CAS servers don't have this issue.

and regarding
"@Belinda Ma: Why did you tag this as answer? As you might see, this thread is far away from being answered!" 

I see this happen a lot, not to say it happens too many times; some microsoft staff replies on a thread and marks his own reply as being "the answer" without any confirmation from the thread starter or any other confirmation that it actually is the answer. Scoring easy points. I really hate that when they do that, it gives you false hope of finding a resolved issue, which turns out to not being resolved at all. They really need stop doing that!




April 1st, 2015 6:01am

You are so right about this. This seems to be a growing trend among the moderators and Microsoft staff here. The best thing you can do is report them to customer service and be sure to talk to someone outside their department.
Free Windows Admin Tool Kit Click here and download it now
April 1st, 2015 6:55am

Same issue here Exchange 2013 CU8. The error only occurs on mailbox servers, the CAS servers don't have this issue.

and regarding
"@Belinda Ma: Why did you tag this as answer? As you might see, this thread is far away from being answered!" 

I see this happen a lot, not to say it happens too many times; some microsoft staff replies on a thread and marks his own reply as being "the answer" without any confirmation from the thread starter or any other confirmation that it actually is the answer. Scoring easy points. I really hate that when they do that, it gives you false hope of finding a resolved issue, which turns out to not being resolved at all. They really need stop doing that!




April 1st, 2015 10:00am

Same issue here Exchange 2013 CU8. The error only occurs on mailbox servers, the CAS servers don't have this issue.

and regarding
"@Belinda Ma: Why did you tag this as answer? As you might see, this thread is far away from being answered!" 

I see this happen a lot, not to say it happens too many times; some microsoft staff replies on a thread and marks his own reply as being "the answer" without any confirmation from the thread starter or any other confirmation that it actually is the answer. Scoring easy points. I really hate that when they do that, it gives you false hope of finding a resolved issue, which turns out to not being resolved at all. They really need stop doing that!




Free Windows Admin Tool Kit Click here and download it now
April 1st, 2015 10:00am

I'm encountering the same issue(s).  In short:

1. We upgraded to Exchange 2013 CU7 and started seeing the same errors.
2. As pointed out, they errors ONLY happen on Mailbox servers and not CAS servers.
3. They appear to happen every 12 hours.  (The time moves by a minute or two each day.)

Thanks,

Robert
April 13th, 2015 11:51am

I have pointed out the hippocracy of the Microsoft tech's marking their own non-answers as answers for years. Nothing seems to change, they do it all the time and it is a shame. I don't have time for threads marked with answers only to find (like this one) nothing is solved.

That said, we are using Exchange 2013 CU8 with both mailbox roles and CAS roles installed on the same machine. The full error is below.

Scenario: ProcessKillBit. Failed to read killbit list file because of exception System.IO.IOException: The process cannot access the file 'E:\Exchange2013-v15\ClientAccess\owa\prem\15.0.1076.9\ext\killbit\killbit.xml' because it is being used by another process.
   at System.IO.__Error.WinIOError(Int32 errorCode, String maybeFullPath)
   at System.IO.FileStream.Init(String path, FileMode mode, FileAccess access, Int32 rights, Boolean useRights, FileShare share, Int32 bufferSize, FileOptions options, SECURITY_ATTRIBUTES secAttrs, String msgPath, Boolean bFromProxy, Boolean useLongPath, Boolean checkHost)
   at System.IO.FileStream..ctor(String path, FileMode mode, FileAccess access, FileShare share, Int32 bufferSize, FileOptions options, String msgPath, Boolean bFromProxy)
   at System.IO.FileStream..ctor(String path, FileMode mode, FileAccess access, FileShare share)
   at Microsoft.Exchange.Data.ApplicationLogic.Extension.KillBitHelper.TryReadKillBitFile(Int32& refreshRate, DateTime& lastModifiedTime)

Free Windows Admin Tool Kit Click here and download it now
April 23rd, 2015 7:28am

This issue seems to hitting many.

We have 2 X Exchange 2013 Enterprise CAS and Mailbox roles on same servers operating under Hyper-v 2012R2.

This issue is only occurring on the 1 Exchange node not on both.  The 2 Exchange servers are configured in a DAG.

It does not appear to be impacting operations as far as I cal tell but would like to have a clean log.

Hopefully this additional information can forward this topic and someone can determine the root cause.

Rometheis Wize
Senior ISE & Microsoft Solutions Architect
(Direct) 416-849-2946
rwize@it911.ca
rsw@rometheis.com 


Hi,

I have a problem where Event ID 3028 Source MSExchangeApplicationLogic is beeing logged every 6 hours with 4 same type of events. Here is the log:

Scenario: ProcessKillBit. Failed to read killbit list file because of exception System.IO.IOException: The process cannot access the file 'C:\Program Files\Microsoft\Exchange Server\V15\ClientAccess\owa\prem\15.0.995.29\ext\killbit\killbit.xml' because it is being used by another process.
   at System.IO.__Error.WinIOError(Int32 errorCode, String maybeFullPath)
   at System.IO.FileStream.Init(String path, FileMode mode, FileAccess access, Int32 rights, Boolean useRights, FileShare share, Int32 bufferSize, FileOptions options, SECURITY_ATTRIBUTES secAttrs, String msgPath, Boolean bFromProxy, Boolean useLongPath, Boolean checkHost)
   at System.IO.FileStream..ctor(String path, FileMode mode, FileAccess access, FileShare share, Int32 bufferSize, FileOptions options, String msgPath, Boolean bFromProxy)
   at System.IO.FileStream..ctor(String path, FileMode mode, FileAccess access, FileShare share)
   at System.IO.File.Open(String path, FileMode mode, FileAccess access, FileShare share)
   at Microsoft.Exchange.Data.ApplicationLogic.Extension.KillBitHelper.TryReadKillBitFile(Int32& refreshRate, DateTime& lastModifiedTime)

The environment is single virtual MS Exchange 2013 server running on Windows 2012 R2. DC is running on a separate server.

I can't seem to find any articles or blogs relating to this issue.

Thanks for any help.


April 30th, 2015 4:22pm

Seeing the same thing here - single 2013CU8 server with MB and CAS roles.  Operations seem OK, but I'm skeptical long term.  FWIW, this server also had an issue installing CU8 - the update kept disabling all Exchange services, I had to re-enable them at each step of installation manually via PowerShell.  Not sure if there's a relationship there?
Free Windows Admin Tool Kit Click here and download it now
May 1st, 2015 8:30am

Hello,

Have this problem since CU1 (currently CU7). And don't think updating to CU8 will resolve the issue.

Before putting this server in production, I had a support ticket at microsoft to explain those warnings and errors we already had before the server actually did something so here's the reply I had for this error :

  1. 3028 MSExchangeApplicationLogic Extension N/A Scenario: ProcessKillBit. Failed to read killbit list file because of exception System.IO.IOException

Un problme de reporting qui a apparu sur Exchange 2010, par contre, cela na pas t corrig dans E15 (Exchange 2013) il me reste valider avec la personne en charge quelle est la suite donner;

(translate : A reporting problem that appeared in Exchange 2010, it was not corrected in E15)

So I think we should stop worrying about it : another "bug" microsoft won't care to resolve.

A good ol' "safe to ignore"

-  


May 4th, 2015 10:24am

This topic is archived. No further replies will be accepted.

Other recent topics Other recent topics